windows revision 1.1.1.16
1 2 #------------------------------------------------------------------------------ 3 # $File: windows,v 1.73 2026/04/20 14:53:18 christos Exp $ 4 # windows: file(1) magic for Microsoft Windows 5 # 6 # This file is mainly reserved for files where programs 7 # using them are run almost always on MS Windows 3.x or 8 # above, or files only used exclusively in Windows OS, 9 # where there is no better category to allocate for. 10 # For example, even though WinZIP almost run on Windows 11 # only, it is better to treat them as "archive" instead. 12 # For format usable in DOS, such as generic executable 13 # format, please specify under "msdos" file. 14 # 15 16 17 # Summary: Outlook Express DBX file 18 # Created by: Christophe Monniez 19 # Update: Joerg Jenderek 20 # URL: http://fileformats.archiveteam.org/wiki/Outlook_Express_Database 21 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/dbx.trid.xml 22 # https://sourceforge.net/projects/ol2mbox/files/LibDBX/ 23 # v1.0.4/libdbx_1.0.4.tar.gz/FILE-FORMAT 24 # Note: called "Outlook Express Database" by TrID and DROID via PUID fmt/838 fmt/839 25 # and partly verified by `undbx --verbosity 4 Posteingang.dbx` 26 0 string \xCF\xAD\x12\xFE 27 # skip DROID fmt-838-signature-id-1193.dbx fmt-839-signature-id-1194.dbx by check for valid file size 28 >0x7C ulelong >0 MS Outlook Express DBX file 29 #!:mime application/octet-stream 30 #!:mime application/vnd.ms-outlook 31 !:mime application/x-ms-dbx 32 !:ext dbx 33 >>4 byte =0xC5 \b, message database 34 >>4 byte =0xC6 \b, folder database 35 >>4 byte =0xC7 \b, account information 36 >>4 byte =0x30 \b, offline database 37 # version like: 5.2 5.5 (typical) 38 >>20 ulequad !0x0000000500000005 \b, version 39 # major version 40 >>>24 ulelong x %u 41 # minor version 42 >>>20 ulelong x \b.%u 43 # CLSID: 6F74FDC5-E366-11d1-9A4E-00C04FA309D4~Message 6F74FDC6-E366-11D1-9A4E-00C04FA309D4~Folder 44 # 26FE9D30-1A8F-11D2-AABF-006097D474C4~offline 45 #>>4 guid x \b, CLSID %s 46 # file size; total size of file; sometimes real size a little bit higher 47 >>0x7C ulelong x \b, ~ %u bytes 48 # highest Email ID; the next email will have a number one higher than this 49 >>0x5c ulelong x \b, highest ID %#x 50 # item count; number of items stored in this DBX file 51 >>0xC4 ulelong x \b, %u item 52 # plural s 53 >>0xC4 ulelong !1 \bs 54 # index pointer; file offset pointing to a page of Data Indexes 55 >>0xE4 ulelong >0 \b, index pointer %#x 56 57 # From: Joerg Jenderek 58 # URL: http://fileformats.archiveteam.org/wiki/Nickfile 59 # https://www.nirsoft.net/utils/outlook_nk2_edit.html 60 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/n/nk2.trid.xml 61 # https://github.com/libyal/libnk2/blob/main/documentation 62 # Nickfile%20(NK2)%20format.asciidoc 63 # Note: called "Outlook Nickfile" by TrID & TestDisk and 64 # "Outlook Nickname File" by Microsoft Outlook and 65 # "Outlook AutoComplete File" by Nirsoft NK2Edit 66 # partly verfied by NK2Edit Raw Text Edit Mode 67 0 ubelong 0x0DF0ADBA MS Outlook Nickfile 68 #!:mime application/octet-stream 69 #!:mime application/vnd.ms-outlook 70 !:mime application/x-ms-nickfile 71 !:ext nk2/dat/bak 72 # nick is used by "older" Outlook; dat is used by "newer" Outlook (probably 2010 - 2016); bak is used for backup 73 #!:ext nick/nk2/dat/bak 74 # Unknown; probably a version indicator like: 0000000Ah 0000000Ch 75 >4 ulelong x \b, probably version %u 76 # Unknown2; probably a version indicator like: 1 0 77 >8 ulelong x \b.%u 78 # number of rows (nickname or alias items) in file 79 >12 ulelong x \b, %u items 80 # number of item entries/columns/properties value like: 17h 81 >16 ulelong x \b, %u entries 82 # value type/property tag: 001Fh~4 bytes for data size of UTF-16 LE string 83 >20 uleshort x \b, value type %#4.4x 84 # entry type/property identifier: 6001h~PR_DOTSTUFF_STATE/PR_NICK_NAME_W 85 >22 uleshort x \b, entry type %#4.4x 86 # Reserved like: 0013FD90h 87 #>24 ulelong x \b, reserved %#8.8x 88 # value data array/Irrelevant Union like: 0000000004E31A80h 89 #>28 ulequad x \b, data %#16.16llx 90 # UTF-16 91 >20 uleshort =0x001F 92 # unicode string bytes like: 2Ch 93 >>36 ulelong x \b, %u bytes 94 # unicode string value PT_UNICODE like: janesmith (a] contoso.org 95 >>40 lestring16 x "%s" 96 97 # Summary: Windows crash dump 98 # Created by: Andreas Schuster (https://computer.forensikblog.de/) 99 # https://web.archive.org/web/20101125060849/https://computer.forensikblog.de/en/2008/02/64bit_magic.html 100 # Modified by (1): Abel Cheung (Avoid match with first 4 bytes only) 101 # Modified by (2): Joerg Jenderek (addtional fields, extension, URL) 102 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/dmp.trid.xml 103 # https://gitlab.com/qemu-project/qemu/-/blob/master/include/qemu/win_dump_defs.h 104 # Note: called "Windows memory dump" by TrID 105 # and verified by like Windows Kit `Dumpchk.exe 043022-18703-01.dmp` 106 # and partly by NirSoft `BlueScreenView.exe 043022-18703-01.dmp` 107 # char Signature[4] 108 0 string PAGE 109 # char ValidDump[4] 110 >4 string DUMP MS Windows 32bit crash dump 111 #!:mime application/octet-stream 112 !:mime application/x-ms-dmp 113 # like: Mini111013-01.dmp 114 !:ext dmp 115 # major version like: 15 116 >>8 ulelong x \b, version %u 117 # minor version like: 2600 118 >>12 ulelong x \b.%u 119 # DirectoryTableBase like: 709000 120 #>>16 ulelong x \b, DirectoryTableBase %#x 121 # PfnDatabase like: 805620c8 122 #>>20 ulelong x \b, PfnDatabase %#x 123 # PsLoadedModuleList like: 8055d720 124 #>>24 ulelong x \b, PsLoadedModuleList %#x 125 # PsActiveProcessHead like:805638b8 126 #>>28 ulelong x \b, PsActiveProcessHead %#x 127 # MachineImageType like: 14c (intel x86) 128 >>32 ulelong !0x14c \b, MachineImageType %#x 129 # NumberProcessors like: 2 130 >>36 ulelong x \b, %u processors 131 # BugcheckCode like: e2 132 #>>40 ulelong x \b, BugcheckCode %#x 133 # BugcheckParameter1 like: 0 134 #>>44 ulelong x \b, BugcheckParameter1 %#x 135 # BugcheckParameter2 like: 0 136 #>>48 ulelong x \b, BugcheckParameter2 %#x 137 # BugcheckParameter3 like: 0 138 #>>52 ulelong x \b, BugcheckParameter3 %#x 139 # BugcheckParameter4 like: 0 140 #>>56 ulelong x \b, BugcheckParameter4 %#x 141 # VersionUser[32]; like "PAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGE" "" 142 #>>60 string x \b, VersionUser "%.32s" 143 # uint32_t reserved0 like: 45474101 144 #>>92 ulelong x \b, reserved0 %#x 145 >>0x05c byte 0 \b, no PAE 146 >>0x05c byte 1 \b, PAE 147 # KdDebuggerDataBlock like: 8054d2e0 148 #>>96 ulelong x \b, KdDebuggerDataBlock %#x 149 # uint8_t PhysicalMemoryBlockBuffer[700] 150 # WinDumpPhyMemDesc32 NumberOfRuns like: 45474150 151 #>>100 ulelong x \b, NumberOfRuns %#x 152 # WinDumpPhyMemDesc32 uint32_t NumberOfPages like: 1162297680 153 #>>104 ulelong x \b, NumberOfPages %#x 154 # WinDumpPhyMemRun32 Run[86]; 688 bytes 155 #>>108 ulelong x \b, BasePage %#x 156 #>>112 ulelong x \b, PageCount %#x 157 # uint8_t reserved1[3200] 158 #>>800 string x \b, reserved "%s" 159 #>>4000 ulelong x \b, RequiredDumpSpace %#x 160 # uint8_t reserved2[92]; 161 #>>4004 string x \b, reserved2 "%s" 162 >>0xf88 lelong 1 \b, full dump 163 >>0xf88 lelong 2 \b, kernel dump 164 >>0xf88 lelong 3 \b, small dump 165 # like: 4 166 >>0xf88 lelong >3 \b, dump type (%#x) 167 # WinDumpPhyMemDesc32 uint32_t NumberOfPages like: 1162297680 168 # GRR: IS THIS TRUE? VALUE IS SOMETIMES VERY HIGH! 169 #>>104 ulelong x \b, NumberOfPages %#x 170 >>0x068 lelong x \b, %d pages 171 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/dmp-64.trid.xml113o 172 # Note: called "Windows 64bit Memory Dump" by TrID 173 # char ValidDump[4] 174 >4 string DU64 MS Windows 64bit crash dump 175 #!:mime application/octet-stream 176 !:mime application/x-ms-dmp 177 # like: c:\Windows\Minidump\020322-18890-01.dmp c:\Windows\MEMORY.DMP 178 !:ext dmp 179 # major version like: 15 180 >>8 ulelong x \b, version %u 181 # minor version like: 9600 19041 22621 182 >>12 ulelong x \b.%u 183 # DirectoryTableBase like: 001ab000 184 #>>16 ulequad x \b, DirectoryTableBase %#llx 185 # PfnDatabase like: fffffa8000000000 186 #>>24 ulequad x \b, PfnDatabase %#llx 187 # PsLoadedModuleList like: fffff800c553f650 188 #>>32 ulequad x \b, PsLoadedModuleList %#llx 189 # PsActiveProcessHead like: fffff800c5525400 190 #>>40 ulequad x \b, PsActiveProcessHead %#llx 191 # MachineImageType like: 00008664 192 >>48 ulelong !0x8664 \b, MachineImageType %#x 193 # NumberProcessors like: 2 4 194 >>52 ulelong x \b, %u processors 195 # BugcheckCode like: 1000007e 196 #>>56 ulelong x \b, BugcheckCode %#x 197 # unused0 198 #>>60 ulelong x \b, unused0 %#x 199 # BugcheckParameter1 like: ffffffffc0000005 200 #>>64 ulequad x \b, BugcheckParameter1 %#llx 201 # BugcheckParameter2 like: fffff801abb2158f 202 #>>72 ulequad x \b, BugcheckParameter2 %#llx 203 # BugcheckParameter3 like: ffffd000290d4288 204 #>>80 ulequad x \b, BugcheckParameter3 %#llx 205 # BugcheckParameter4 like: ffffd000290d3aa0 206 #>>88 ulequad x \b, BugcheckParameter4 %#llx 207 # VersionUser[32]; like "" "PAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGE" "" 208 #>>96 string x \b, VersionUser "%.32s" 209 # KdDebuggerDataBlock like: fffff800c550c530 210 #>>128 ulequad x \b, KdDebuggerDataBlock %#llx 211 # uint8_t PhysicalMemoryBlockBuffer[704] 212 # WinDumpPhyMemDesc64 NumberOfRuns like: 6 7 0x45474150 213 #>>136 ulelong x \b, NumberOfRuns %#x 214 # WinDumpPhyMemDesc64 unused like: 0 0x45474150 215 #>>140 ulelong x \b, unused %#x 216 # WinDumpPhyMemRun64 Run[43] BasePage like: 1 217 #>>152 ulequad x \b, BasePage %#llx 218 # WinDumpPhyMemRun64 Run[43] PageCount like: 57h 219 #>>160 ulequad x \b, PageCount %#llx 220 # uint8_t ContextBuffer[3000] like: "" "\001" "\0207J\266\001\340\377\377&8\007\312" 221 #>>840 string x \b, ContextBuffer "%s" 222 # WinDumpExceptionRecord ExceptionCode 223 #>>3840 ulelong x \b, ExceptionCode %#x 224 # WinDumpExceptionRecord ExceptionFlags 225 #>>3844 ulelong x \b, ExceptionFlags %#x 226 # WinDumpExceptionRecord ExceptionRecord 227 #>>3848 ulequad x \b, ExceptionRecord %#llx 228 # WinDumpExceptionRecord ExceptionAddress 229 #>>3856 ulequad x \b, ExceptionAddress %#llx 230 # WinDumpExceptionRecord NumberParameters 231 #>>3864 ulelong x \b, NumberParameters %#x 232 # WinDumpExceptionRecord unused 233 #>>3868 ulelong x \b, unsed %#x 234 # WinDumpExceptionRecord ExceptionInformation[15] 235 #>>3872 ulequad x \b, ExceptionInformation[0] %#llx 236 # https://learn.microsoft.com/en-us/troubleshoot/windows-server/performance/memory-dump-file-options 237 # but DumpType like: 4~small 5~full (MEMORY.DMP) 6~kernel (MEMORY.DMP) 238 >>0xf98 ulelong x \b, 239 >>>0xf98 lelong 5 full dump 240 >>>0xf98 lelong 6 kernel dump 241 >>>0xf98 lelong 4 small dump 242 # This probably never occur 243 >>>0xf98 default x DumpType 244 >>>>0xf98 ulelong x (%#x) 245 # WinDumpPhyMemDesc64 uint64_t NumberOfPages like: 3142425 8341923 8366500 1162297680 4992030524978970960 246 # GRR: IS THIS TRUE? VALUE IS SOMETIMES VERY HIGH! 247 >>0x090 lequad x \b, %lld pages 248 249 # Summary: Vista Event Log 250 # Created by: Andreas Schuster (https://computer.forensikblog.de/) 251 # Update: Joerg Jenderek 252 # URL: https://github.com/libyal/libevtx/blob/main/documentation/Windows%20XML%20Event%20Log%20(EVTX).asciidoc 253 # Reference (1): https://web.archive.org/web/20110803085000/ 254 # https://computer.forensikblog.de/en/2007/05/some_magic.html 255 # http://mark0.net/download/triddefs_xml.7z/defs/e/evtx.trid.xml 256 # Note: called "Vista Event Log" by TrID and "Event Log" by Windows 257 # verified partly by `wevtutil.exe gli /lf:true dumpfile.evtx` 258 0 string ElfFile\0 MS Windows 259 #!:mime application/octet-stream 260 !:mime application/x-ms-evtx 261 !:ext evtx 262 # Major+Minor format version: 3.1~Vista and later 3.2~Windows 10 (2004) and later 263 >0x24 ulelong =0x00030001 Vista-8.1 Event Log 264 >0x24 ulelong !0x00030001 10-11 Event Log, version 265 >>0x26 uleshort x %u 266 >>0x24 uleshort x \b.%u 267 >0x2a leshort x \b, %d chunks 268 >>0x10 lelong x \b (no. %d in use) 269 >0x18 lelong >1 \b, next record no. %d 270 >0x18 lelong =1 \b, empty 271 >0x78 lelong &1 \b, DIRTY 272 >0x78 lelong &2 \b, FULL 273 274 # Summary: Windows Event Trace Log 275 # From: Joerg Jenderek 276 # URL: http://fileformats.archiveteam.org/wiki/ETL 277 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/e/etl.trid.xml 278 # https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/etw/tracelog/trace_logfile_header.htm 279 # Note: called "Window tracing/diagnostic binary log" by TrID 280 # verified by `tracerpt.EXE Wifi.etl -of EVTX` 281 # and by etl-parser `etl2xml --input AMSITrace.etl --output AMSITrace.xml` 282 # Every ETL file begins with a WMI_BUFFER_HEADER, a SYSTEM_TRACE_HEADER and a TRACE_LOGFILE_HEADER 283 0 ubyte 0 284 # look for corresponding encoded as UTF-16 file name extension like in: boot_BASE+CSWITCH_1.etl 285 >0 search/0x699087/b .\0e\0t\0l\0\0\0 286 # GRR: line above only works if in ../../src/file.h FILE_BYTES_MAX is raised above 699086h (6,59 MiB) 287 >>0 use trace-etl 288 # display information of Windows Performance Analyzer Trace File (file name) 289 0 name trace-etl 290 >0 ubyte x Windows Event Trace Log 291 #!:mime application/x-ms-etl 292 # http://extension.nirsoft.net/etl 293 !:mime application/etl 294 !:ext etl 295 # look for DOS drive letter part of log file name like: PhotosAppTracing_startedInBGMode.etl 296 >0 search/0x2b4/sb :\0\x5c\0 297 # like: "c:\Windows\Logs\NetSetup\service.0.etl" "C:\Windows\System32\LogFiles\WMI\Wifi.etl" 298 >>&-2 lestring16 x "%s" 299 300 # Summary: Windows System Deployment Image 301 # Created by: Joerg Jenderek 302 # URL: http://en.wikipedia.org/wiki/System_Deployment_Image 303 # Reference: http://skolk.livejournal.com/1320.html 304 0 string $SDI 305 >4 string 0001 System Deployment Image 306 !:mime application/x-ms-sdi 307 #!:mime application/octet-stream 308 # \Boot\boot.sdi 309 !:ext sdi 310 # MDBtype: 0~Unspecified 1~RAM 2~ROM 311 >>8 ulequad !0 \b, MDBtype %#llx 312 # BootCodeOffset 313 >>16 ulequad !0 \b, BootCodeOffset %#llx 314 # BootCodeSize 315 >>24 ulequad !0 \b, BootCodeSize %#llx 316 # VendorID 317 >>32 ulequad !0 \b, VendorID %#llx 318 # DeviceID 319 >>40 ulequad !0 \b, DeviceID %#llx 320 # DeviceModel 321 >>48 ulequad !0 \b, DeviceModel %#llx 322 >>>56 ulequad !0 \b%llx 323 # DeviceRole 324 >>64 ulequad !0 \b, DeviceRole %#llx 325 # Reserved1; reserved fields and gaps between BLOBs are padded with \0 326 #>>72 ulequad !0 \b, Reserved1 %#llx 327 # RuntimeGUID 328 >>80 ulequad !0 \b, RuntimeGUID %#llx 329 >>>88 ulequad !0 \b%llx 330 # RuntimeOEMrev 331 >>96 ulequad !0 \b, RuntimeOEMrev %#llx 332 # Reserved2 333 #>>104 ulequad !0 \b, Reserved2 %#llx 334 # BLOB alignment value in pages, as specified in sdimgr /pack: 1~4K 2~8k 335 >>112 ulequad !0 \b, PageAlignment %llu 336 # Reserved3[48] 337 #>>120 ulequad !0 \b, Reserved3 %#llx 338 # SDI checksum 39h 339 >>0x1f8 ulequad x \b, checksum %#llx 340 # BLOBtype[8] \0-padded: PART, WIM , BOOT, LOAD, DISK 341 >>0x400 string >\0 \b, type %-3.8s 342 # 0~non-filesystem 7~NTFS 6~BIGFAT 343 >>>0x420 ulequad !0 (%#llx) 344 # ATTRibutes 345 >>>0x408 ulequad !0 %#llx attributes 346 # Offset 347 >>>0x410 ulequad x at %#llx 348 # print 1 space after size and then handles NTFS boot sector by ./filesystems 349 >>>0x418 ulequad >0 %llu bytes 350 >>>>(0x410.l) indirect x 351 # 2nd BLOB: WIM 352 >>0x440 string >\0 \b, type %-3.8s 353 >>>0x428 ulequad !0 (%#llx) 354 # ATTRibutes 355 >>>0x448 ulequad !0 %#llx attributes 356 # Offset 357 >>>0x450 ulequad x at %#llx 358 >>>0x458 ulequad >0 %llu bytes 359 >>>>(0x450.l) indirect x 360 # 3rd BLOB 361 >>0x480 string >\0 \b, type %-3.8s 362 363 # Summary: Windows boot status log BOOTSTAT.DAT 364 # From: Joerg Jenderek 365 # Reference: https://www.geoffchappell.com/notes/windows/boot/bsd.htm 366 # Note: mainly refers to older Windows Vista, sometimes 367 # BOOTSTAT.DAT only contains nulls or invalid data 368 # checking for valid version below 5 369 0 ulelong <5 370 # skip many ISO images by checking for valid 64 KiB file size 371 >8 ulelong =0x00010000 372 >>0 use bootstat-dat 373 # display information of BOOTSTAT.DAT 374 0 name bootstat-dat 375 >0 ulelong x Windows boot log 376 #!:mime application/octet-stream 377 !:mime application/x-ms-dat 378 # BOOTSTAT.DAT in BOOT subdirectory 379 !:ext dat 380 # apparently a version number: 2 for older like Vista, 3, 4 Windows 10 381 >0 ulelong >2 \b, version %u 382 # apparently the size of the header: often 10h in older Windows, 14h, 18h 383 >4 ulelong !0x10 \b, header size %#x 384 #>4 ulelong !0x10 \b, header size %u 385 # apparently the size of the file: always 0x00010000~64KiB 386 # the file is acceptable to BOOTMGR only if it is exactly 64 KiB 387 >8 ulelong !0x00010000 \b, file size %#x 388 # size of valid data, in bytes: C8h 50h 172h 5D5Ch 389 >0xc ulelong x \b, %#x valid bytes 390 # skip header and jump to first bootstat entry and display information 391 >(0x4.l-1) ubyte x 392 >>&0 use bootstat-entry 393 # jump to first entry again because pointer are bad after "use" 394 >(0x4.l-1) ubyte x 395 # by 1st entry size jump to 2nd entry and display information 396 >>&(&0x18.l-1) ubyte x 397 >>>&0 use bootstat-entry 398 # jump to possible 3rd boot entry and display information 399 # >(0x4.l-1) ubyte x 400 # >>&(&0x18.l-1) ubyte x 401 # >>>&(&0x18.l-1) ubyte x 402 # >>>>&0 use bootstat-entry 403 # display BOOTSTAT.DAT entry 404 0 name bootstat-entry 405 #>0x00 ubequad x \b, ENTRY %16.16llx 406 # size of entry, in bytes: 40h(init) 78h(launced) 9Ch 407 #>0x18 ulelong x \b; entry size %u 408 >0x18 ulelong x \b; entry size %#x 409 # time stamp, in seconds 410 >0x00 ulelong x \b, %#x seconds 411 # always zero, significance unknown 412 >0x04 ulelong !0 \b, not null %u 413 # GUID of event source; but empty if event source is BOOTMGR 414 >0x08 ubequad !0 \b, GUID %#16.16llx 415 >>0x10 ubequad x \b%16.16llx 416 # severity code: 1~informational 3~errors 417 >0x1C ulelong !1 \b, severity %#x 418 # apparently a version number: 2 419 >0x20 ulelong !2 \b, version %u 420 # event identifier 1~log file initialised 11h~boot application launched 421 #>0x24 ulelong x \b, event %#x 422 >0x24 ulelong !1 423 >>0x24 ulelong !0x11 \b, event %#x 424 # entry data; size depends on event identifier 425 #>0x28 ubequad x \b, data %#16.16llx 426 >0x24 ulelong =0x1 \b, Init 427 # always 0, significance unknown 428 >>0x34 uleshort !0 \b, not null %u 429 # always 7, significance unknown 430 >>0x36 uleshort !7 \b, not seven %u 431 # year 432 >>0x28 uleshort x %u 433 # month 434 >>0x2A uleshort x \b-%u 435 # day 436 >>0x2C uleshort x \b-%u 437 # hour 438 >>0x2E uleshort x %u 439 # minute 440 >>0x30 uleshort x \b:%u 441 # second 442 >>0x32 uleshort x \b:%u 443 # boot application launched 444 >0x24 ulelong =0x11 \b, launched 445 # type of start: 0 normally, 1 or 2 maybe in a recovery sequence 446 >>0x38 uleshort !0 \b, type %u 447 # pathname of boot application, as null-terminated Unicode string; typically 448 # \Windows\system32\winload.exe \Windows\system32\winload.efi 449 >>0x3C lestring16 x %s 450 451 # Summary: Windows Error Report text files 452 # URL: https://en.wikipedia.org/wiki/Windows_Error_Reporting 453 # Reference: https://www.nirsoft.net/utils/app_crash_view.html 454 # Created by: Joerg Jenderek 455 # Note: in directories %ProgramData%\Microsoft\Windows\WER\{ReportArchive,ReportQueue} 456 # %LOCALAPPDATA%\Microsoft\Windows\WER\{ReportArchive,ReportQueue} 457 0 lestring16 Version= 458 >22 lestring16 EventType Windows Error Report 459 !:mime text/plain 460 # Report.wer 461 !:ext wer 462 463 # Summary: Windows 3.1 group files 464 # Extension: .grp 465 # Created by: unknown 466 0 string \120\115\103\103 MS Windows 3.1 group files 467 468 469 # Summary: Old format help files 470 # URL: https://en.wikipedia.org/wiki/WinHelp 471 # Reference: https://www.oocities.org/mwinterhoff/helpfile.htm 472 # Update: Joerg Jenderek 473 # Created by: Dirk Jagdmann <doj (a] cubic.org> 474 # 475 # check and then display version and date inside MS Windows HeLP file fragment 476 0 name help-ver-date 477 # look for Magic of SYSTEMHEADER 478 >0 leshort 0x036C 479 # version Major 1 for right file fragment 480 >>4 leshort 1 Windows 481 # print non empty string above to avoid error message 482 # Warning: Current entry does not yet have a description for adding a MIME type 483 # not officially registered at IANA 484 #!:mime application/winhelp 485 #!:mime application/winhlp 486 !:mime application/x-winhelp 487 # version Minor of help file format is hint for windows version 488 # HC30 Windows 3.0 help file 489 >>>2 leshort 15 3.0 490 # HC31 Windows 3.1 help file 491 >>>2 leshort 21 3.1 492 # WMVC/MMVC media view file 493 >>>2 leshort 27 494 # MVC or HCW 4.00 Windows 95 495 >>>2 leshort 33 95 496 # next line should not happen 497 >>>2 default x y.z 498 >>>>2 leshort x %#x 499 # to complete message string like "MS Windows 3.x help file" 500 >>>2 leshort !27 501 # HLP or few MVB like NOTEPLAY.MVB 502 >>>>2 leshort x help 503 !:ext hlp 504 # URL: http://fileformats.archiveteam.org/wiki/Multimedia_Viewer_Book 505 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/m/mvb.trid.xml 506 # Note: called "Multimedia Viewer Book" by TrID and by DROID via PUID fmt/1800 507 >>>2 leshort =27 Multimedia Viewer Book 508 !:ext mvb 509 # GenDate often older than file creation date 510 >>>6 ldate x \b, %s 511 # flags determine the compression 512 #>>>10 uleshort x \b, flags %#x 513 >>>2 leshort <17 514 # HelpFileTitle 515 >>>>12 string x \b, title "%s" 516 >>>2 leshort >16 517 # SYSTEMREC[].RecordType type of data in record; 1~help file title 2~COPYRIGHT 3~TOPICOFFSET Contents 4~Macro 5~*.ICO 6~HPJ-structure 518 #>>>>12 uleshort x \b, RecordType %u 519 # DataSize size of data 520 #>>>>14 uleshort x \b, DataSize %u 521 >>>>12 uleshort 1 522 >>>>>14 pstring/h >\0 \b, title "%s" 523 # Magic for HeLP files 524 # URL: http://fileformats.archiveteam.org/wiki/HLP_(WinHelp) 525 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/h/hlp.trid.xml 526 # Note: called "Windows HELP File" by TrID, "Windows Help File" by DROID via PUID fmt/474 and 527 # "WinHelp help file" by shared MIME-info database from freedesktop.org 528 0 lelong 0x00035f3f 529 # ./windows (version 5.25) labeled the entry as "MS Windows 3.x help file" 530 # file header magic 0x293B at DirectoryStart+9 531 >(4.l+9) uleshort 0x293B MS 532 # URL: http://fileformats.archiveteam.org/wiki/WinHelp_annotation 533 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/a/ann.trid.xml 534 # look for @VERSION bmf.. like IBMAVW.ANN 535 >>0xD4 string =\x62\x6D\x66\x01\x00 Windows help annotation 536 !:mime application/x-winhelp 537 !:ext ann 538 >>0xD4 string !\x62\x6D\x66\x01\x00 539 # "GID Help index" by TrID by gid.trid.xml 540 # sometimes at little higher offset like in corelap.GID 541 >>>(4.l+0x65) search/26 |Pete Windows help Global Index 542 !:mime application/x-winhelp 543 !:ext gid 544 # HeLP Bookmark or 545 # Multimedia_Viewer_Book or 546 # "Windows HELP File" by TrID by hlp.trid.xml 547 >>>(4.l+0x65) default x 548 # maybe there exist a cleaner way to detect HeLP fragments 549 # brute search for Magic 0x036C with matching Major maximal 13 iterations 550 # https://sembiance.com/fileFormatSamples/document/multimediaViewerBook/viewerht.mvb 551 >>>>16 search/0x1bbc370/s \x6c\x03 552 >>>>>&0 use help-ver-date 553 >>>>>&4 leshort !1 554 # viewerht.mvb 555 >>>>>>&-2 search/0x1c4b6f0/s \x6c\x03 556 >>>>>>>&0 use help-ver-date 557 >>>>>>>&4 leshort !1 558 # https://sembiance.com/fileFormatSamples/document/multimediaViewerBook/clarkhow.mvb 559 >>>>>>>>&0 search/0x34ab80/s \x6c\x03 560 >>>>>>>>>&0 use help-ver-date 561 >>>>>>>>>&4 leshort !1 562 >>>>>>>>>>&0 search/0x473ab0/s \x6c\x03 563 >>>>>>>>>>>&0 use help-ver-date 564 >>>>>>>>>>>&4 leshort !1 565 >>>>>>>>>>>>&0 search/0x739680/s \x6c\x03 566 >>>>>>>>>>>>>&0 use help-ver-date 567 >>>>>>>>>>>>>&4 leshort !1 568 >>>>>>>>>>>>>>&0 search/0x76c030/s \x6c\x03 569 >>>>>>>>>>>>>>>&0 use help-ver-date 570 >>>>>>>>>>>>>>>&4 leshort !1 571 >>>>>>>>>>>>>>>>&0 search/0x805c80/s \x6c\x03 572 # GCC.HLP is detected after 7 iterations 573 >>>>>>>>>>>>>>>>>&0 use help-ver-date 574 >>>>>>>>>>>>>>>>>&4 leshort !1 575 >>>>>>>>>>>>>>>>>>&0 search/0x805c80/s \x6c\x03 576 >>>>>>>>>>>>>>>>>>>&0 use help-ver-date 577 >>>>>>>>>>>>>>>>>>>&4 leshort !1 578 >>>>>>>>>>>>>>>>>>>>&0 search/0xb63480/s \x6c\x03 579 >>>>>>>>>>>>>>>>>>>>>&0 use help-ver-date 580 >>>>>>>>>>>>>>>>>>>>>&4 leshort !1 581 >>>>>>>>>>>>>>>>>>>>>>&0 search/0xb7fe80/s \x6c\x03 582 >>>>>>>>>>>>>>>>>>>>>>>&0 use help-ver-date 583 >>>>>>>>>>>>>>>>>>>>>>>&4 leshort !1 584 >>>>>>>>>>>>>>>>>>>>>>>>&0 search/0xb8ade0/s \x6c\x03 585 >>>>>>>>>>>>>>>>>>>>>>>>>&0 use help-ver-date 586 >>>>>>>>>>>>>>>>>>>>>>>>>&4 leshort !1 587 >>>>>>>>>>>>>>>>>>>>>>>>>>&0 search/0x371d4/s \x6c\x03 588 >>>>>>>>>>>>>>>>>>>>>>>>>>>&0 use help-ver-date 589 >>>>>>>>>>>>>>>>>>>>>>>>>>>&4 leshort !1 590 >>>>>>>>>>>>>>>>>>>>>>>>>>>>&0 search/0x371d4/s \x6c\x03 591 >>>>>>>>>>>>>>>>>>>>>>>>>>>>>&0 use help-ver-date 592 >>>>>>>>>>>>>>>>>>>>>>>>>>>>>&4 leshort !1 593 # https://sembiance.com/fileFormatSamples/document/multimediaViewerBook/arivideo.mvb 594 >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>8 lelong !0xFFffFFff Windows Multimedia Viewer Book 595 !:mime application/x-winhelp 596 !:ext mvb 597 # repeat search again or following default line does not work 598 >>>>16 search/0x49AF/s \x6c\x03 599 # remaining files should be HeLP Bookmark WinHlp32.BMK (XP 32-bit) or WinHlp32 (Windows 7 8.1 64-bit) 600 # typically found inside directory %LOCALAPPDATA%\Help 601 >>>>16 default x Windows help Bookmark 602 !:mime application/x-winhelp 603 !:ext /bmk 604 # DirectoryStart offset of FILEHEADER of internal directory 605 #>4 lelong x \b, DirectoryStart %8.8x 606 ## FirstFreeBlock normally for *HLP FFFFFFFFh if no free list or 10h for *ANN 607 #>>8 lelong x \b, FirstFreeBlock %#8.8x 608 ## ReservedSpace normally 042Fh AFh for *.ANN 609 #>>(4.l) lelong x \b, ReservedSpace %#8.8x 610 ## UsedSpace normally 0426h A6h for *.ANN 611 #>>(4.l+4) lelong x \b, UsedSpace %#8.8x 612 ## FileFlags normally 04... 613 #>>(4.l+5) lelong x \b, FileFlags %#8.8x 614 ## file header magic 0x293B 615 #>>(4.l+9) uleshort x \b, file header magic %#4.4x 616 ## file header Flags 0x0402 617 #>>(4.l+11) uleshort x \b, file header Flags %#4.4x 618 ## file header PageSize 0400h 80h for *.ANN 619 #>>(4.l+13) uleshort x \b, PageSize %#4.4x 620 ## Structure[16] z4 621 #>>(4.l+15) string >\0 \b, Structure_"%-.16s" 622 ## MustBeZero 0 623 #>>(4.l+31) uleshort x \b, MustBeZero %#4.4x 624 ## PageSplits 625 #>>(4.l+33) uleshort x \b, PageSplits %#4.4x 626 ## RootPage 627 #>>(4.l+35) uleshort x \b, RootPage %#4.4x 628 ## MustBeNegOne 0xffff 629 #>>(4.l+37) uleshort x \b, MustBeNegOne %#4.4x 630 ## TotalPages 1 631 #>>(4.l+39) uleshort x \b, TotalPages %#4.4x 632 ## NLevels 0x0001 633 #>>(4.l+41) uleshort x \b, NLevels %#4.4x 634 ## TotalBtreeEntries 635 #>>(4.l+43) ulelong x \b, TotalBtreeEntries %#8.8x 636 ## pages of the B+ tree 637 #>>(4.l+47) ubequad x \b, PageStart %#16.16llx 638 # GRR: offset is not reachable in few samples like STMMHLP.MVB because probably damaged file 639 # or DROID fmt-474-signature-id-748.hlp 640 # or for example run file command with higher --parameter bytes=30335189 641 >(4.l+9) uleshort !0x293B MS Windows Multimedia Viewer Book 642 #!:mime application/octet-stream 643 !:ext mvb 644 # GRR: next line is not executed! 645 >>12 lelong x (damaged or use higher '-P bytes' option) 646 # EntireFileSize; biggest 1551334 for CORELDRW.HLP 30335189 for viewerht.mvb; smallest 28672 for open.mvb 647 >12 lelong x \b, %d bytes 648 649 # start with colon or semicolon for comment line like Back2Life.cnt 650 0 regex \^(:|;) 651 # look for first keyword Base 652 >0 search/45 :Base 653 >>&0 use cnt-name 654 # only solution to search again from beginning , because relative offsets changes when use is called 655 >0 search/45 :Base 656 >0 default x 657 # look for other keyword Title like in putty.cnt 658 >>0 search/45 :Title 659 >>>&0 use cnt-name 660 # 661 # display mime type and name of Windows help Content source 662 0 name cnt-name 663 # skip space at beginning 664 >0 string \040 665 # name without extension and greater character or name with hlp extension 666 >>1 regex/c \^([^\xd>]*|.*\\.hlp) MS Windows help file Content, based "%s" 667 !:mime text/plain 668 !:apple ????TEXT 669 !:ext cnt 670 # URL: https://en.wikipedia.org/wiki/WinHelp 671 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/f/fts.trid.xml 672 # Note: called "Windows Help Full-Text Search index" by TrID 673 # Windows creates a full text search from hlp file, if the user clicks the "Find" tab and enables keyword indexing 674 0 string tfMR MS Windows help Full Text Search index 675 !:mime application/x-winhelp-fts 676 !:ext fts 677 # path of corresponding MS Windows help like: "C:\CDCREATR\creatr32.hlp" "C:\PROGRAMME\IPHOTO PLUS 4\PROGRAMS\Guide.hlp" 678 >16 string >\0 for "%s" 679 # From: Joerg Jenderek 680 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/f/ftg-winhelp.trid.xml 681 # Note: called "Windows Help Full-Text search Group" by TrID 682 0 string gfMR MS Windows help Full Text search Group 683 !:mime application/x-winhelp-ftg 684 !:ext ftg 685 # path of corresponding FTS like: "C:\Windows\Help\winhlp32.FTS" 686 >16 string >\0 for "%s" 687 688 # Summary: Hyper terminal 689 # Created by: unknown 690 # Update: Joerg Jenderek 691 # URL: https://en.wikipedia.org/wiki/HyperACCESS 692 # https://www.hilgraeve.com/hyperterminal/ 693 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/h/ht.trid.xml 694 # Note: called "HyperTerminal data file" by TrID and "HyperTerminal File" on English Windows 695 0 string HyperTerminal\040 696 >14 string 1.0\ --\ HyperTerminal\ data\ file MS Windows HyperTerminal profile 697 #!:mime application/octet-stream 698 !:mime application/x-ms-ht 699 !:ext ht 700 701 # https://ithreats.files.wordpress.com/2009/05/\040 702 # lnk_the_windows_shortcut_file_format.pdf 703 # Summary: Windows shortcut 704 # Created by: unknown 705 # Update: Joerg Jenderek 706 # URL: http://fileformats.archiveteam.org/wiki/Windows_Shortcut 707 # https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-shllink/ 708 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/l/lnk-shortcut.trid.xml 709 # https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-SHLLINK/%5bMS-SHLLINK%5d.pdf 710 # Note: called "Windows Shortcut" by TrID, "Microsoft Windows Shortcut" by DROID via PUID x-fmt/428 and "Windows shortcut file" by ./msdos (v 1.158) 711 # partly verified by command like `lnkinfo AOL.lnk` 712 # 'L' + GUUID 713 # HeaderSize + LinkCLSID 00021401-0000-0000-C000-000000000046 714 0 string \114\0\0\0\001\024\002\0\0\0\0\0\300\0\0\0\0\0\0\106 MS Windows shortcut 715 !:mime application/x-ms-shortcut 716 !:ext lnk 717 # LinkFlags 718 # HasLinkTargetIDList; if set a LinkTargetIDList structure MUST follow the ShellLinkHeader; If is not set, structure MUST NOT be present 719 >20 lelong&1 1 \b, Item id list present 720 # HasLinkInfo; if set a LinkInfo structure MUST follow the ShellLinkHeader or LinkTargetIDList; If is not set, structure MUST NOT be present 721 >20 lelong&2 2 \b, Points to a file or directory 722 >20 lelong&4 4 \b, Has Description string 723 >20 lelong&8 8 \b, Has Relative path 724 >20 lelong&16 16 \b, Has Working directory 725 >20 lelong&32 32 \b, Has command line arguments 726 >20 lelong&64 64 \b, Icon 727 # IconIndex 728 >>56 lelong x \b number=%d 729 # IsUnicode; If set then StringData section contains Unicode-encoded strings 730 >20 lelong&128 128 \b, Unicoded 731 # ForceNoLinkInfo; LinkInfo structure is ignored 732 >20 lelong&256 256 \b, NoLinkInfo 733 # HasExpString; with an EnvironmentVariableDataBlock 734 >20 lelong&512 512 \b, HasEnvironment 735 # look for BlockSize 314h and EnvironmentVariableDataBlock BlockSignature A0000001h 736 >>76 search/1972 \x14\x03\x00\x00\x01\x00\x00\xa0 737 # TargetAnsi (260 bytes); NULL-terminated path to environment variable encoded with system default code page 738 #>>>&0 string x '%s' 739 # TargetUnicode (520 bytes): optional NULL-terminated path to same environment variable Unicode encoded 740 # like: "%windir%\system32\calc.exe" 741 >>>&260 lestring16 x "%s" 742 # RunInSeparateProcess; run in a separate virtual machine when launching a 16-bit application; no examples found 743 >20 lelong&1024 1024 \b, RunInSeparateProcess 744 # Unused1; undefined and MUST be ignored 745 #>20 lelong&2048 2048 \b, Unused1 746 # HasDarwinID; with a DarwinDataBlock 747 >20 lelong&4096 4096 \b, HasDarwinID 748 # look for BlockSize 314h and DarwinDataBlock BlockSignature A0000006h 749 >>76 search/1972 \x14\x03\x00\x00\x06\x00\x00\xa0 750 # DarwinDataAnsi (260 bytes); NULL-terminated application identifier encoded with system default code page; SHOULD be ignored 751 #>>>&0 string x '%s' 752 # DarwinDataUnicode (520 bytes); NULL-terminated application identifier Unicode encoded 753 >>>&260 lestring16 x "%s" 754 # RunAsUser; target application is run as a different user 755 >20 lelong&8192 8192 \b, RunAsUser 756 # HasExpIcon; with an IconEnvironmentDataBlock 757 >20 lelong&16384 16384 \b, HasExpIcon 758 # look for BlockSize 314h and IconEnvironmentDataBlock BlockSignature A0000007h 759 >>76 search/1972 \x14\x03\x00\x00\x07\x00\x00\xa0 760 # TargetAnsi (260 bytes); NULL-terminated path to environment icon variable encoded with system default code page 761 #>>>&0 string x '%s' 762 # TargetUnicode (520 bytes); optional NULL-terminated path to same icon environment variable Unicode encoded 763 # like: "%SystemDrive%\Program Files\YaCy\addon\YaCy.ico" 764 >>>&260 lestring16 x "%s" 765 # NoPidlAlias; represented in the shell namespace; no examples found 766 >20 lelong&32768 32768 \b, NoPidlAlias 767 # Unused2; undefined and MUST be ignored 768 #>20 lelong&65536 65536 \b, Unused2 769 # RunWithShimLayer; with a ShimDataBlock; no examples found 770 >20 lelong&131072 131072 \b, RunWithShimLayer 771 # ForceNoLinkTrack; TrackerDataBlock is ignored; no examples found 772 >20 lelong&262144 262144 \b, ForceNoLinkTrack 773 >20 lelong&262144 0 774 # look for BlockSize 60h, TrackerDataBlock BlockSignature A0000003h, it length 58h and Version 0 775 >>76 search/1972 \x60\x00\x00\x00\x03\x00\x00\xa0\x58\x00\x00\x00\0\0\0\0 776 # MachineID (16 bytes); a NULL-terminated NetBIOS name encoded with system default code page of the machine 777 >>>&0 string x \b, MachineID %0.16s 778 # Droid (32 bytes) 779 # 780 # DroidBirth (32 bytes) 781 # 782 # EnableTargetMetadata; collect target properties and store in PropertyStoreDataBlock 783 >20 lelong&524288 524288 \b, EnableTargetMetadata 784 # look for BlockSize >= Ch, PropertyStoreDataBlock BlockSignature A0000009h 785 #>>76 search/1972 \x00\x00\x09\x00\x00\xa0 786 # PropertyStore (variable) 787 # 788 # DisableLinkPathTracking; EnvironmentVariableDataBlock is ignored; no examples found 789 >20 lelong&1048576 1048576 \b, DisableLinkPathTracking 790 # DisableKnownFolderTracking; SpecialFolderDataBlock and KnownFolderDataBlock are ignored and not saved 791 >20 lelong&2097152 2097152 \b, DisableKnownFolderTracking 792 >20 lelong&2097152 0 793 # look for BlockSize 1Ch and KnownFolderDataBlock BlockSignature A000000Bh 794 >>76 search/1972 \x1c\x00\x00\x00\x0B\x00\x00\xa0 795 # https://learn.microsoft.com/en-us/dotnet/desktop/winforms/controls/known-folder-guids-for-file-dialog-custom-places 796 # KnownFolderID specifies the folder GUID ID 797 # ProgramFiles 905E63B6-C1BF-494E-B29C-65B732D3D21A 798 # ProgramFilesX86 7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E 799 >>>&0 guid x KnownFolderID %s 800 # DisableKnownFolderAlias; unaliased form of the known folder IDList SHOULD be used; no examples found 801 >20 lelong&4194304 4194304 \b, DisableKnownFolderAlias 802 # AllowLinkToLink; link that references another link is enabled; no examples found 803 >20 lelong&8388608 8388608 \b, AllowLinkToLink 804 # UnaliasOnSave; unaliased form of that known folder or the target IDList SHOULD be used; no examples found 805 >20 lelong&16777216 16777216 \b, UnaliasOnSave 806 # PreferEnvironmentPath; path specified in the EnvironmentVariableDataBlock SHOULD be used 807 >20 lelong&33554432 33554432 \b, PreferEnvironmentPath 808 # KeepLocalIDListForUNCTarget; UNC name SHOULD be stored in local path IDList in PropertyStoreDataBlock; no examples found 809 >20 lelong&67108864 67108864 \b, KeepLocalIDListForUNCTarget 810 # FileAttributes 811 >24 lelong&1 1 \b, Read-Only 812 >24 lelong&2 2 \b, Hidden 813 >24 lelong&4 4 \b, System 814 # Reserved1; MUST be zero 815 >24 lelong&8 8 \b, Reserved1 816 >24 lelong&16 16 \b, Directory 817 >24 lelong&32 32 \b, Archive 818 # Reserved2; MUST be zero 819 >24 lelong&64 64 \b, Reserved2 820 >24 lelong&128 128 \b, Normal 821 >24 lelong&256 256 \b, Temporary 822 # no examples found 823 >24 lelong&512 512 \b, Sparse 824 # no examples found 825 >24 lelong&1024 1024 \b, Reparse point 826 >24 lelong&2048 2048 \b, Compressed 827 >24 lelong&4096 4096 \b, Offline 828 # FILE_ATTRIBUTE_NOT_CONTENT_INDEXED; contents need to be indexed 829 >24 lelong&8192 8192 \b, NeedIndexed 830 # FILE_ATTRIBUTE_ENCRYPTED; file or directory is encrypted 831 >24 lelong&16384 16384 \b, Encrypted 832 # value zero means there is no time set on the target 833 >28 leqwdate !0 \b, ctime=%s 834 # Access time of target in UTC 835 >36 leqwdate !0 \b, atime=%s 836 # write time of target in UTC 837 >44 leqwdate !0 \b, mtime=%s 838 # FileSize; 32 bit size of target in bytes 839 >52 lelong x \b, length=%u, window= 840 # ShowCommand; 1~SW_SHOWNORMAL 3~SW_SHOWMAXIMIZED HerzlichMEDION.lnk 7~SW_SHOWMINNOACTIVE YaCy.lnk Privoxy.lnk; All other values like 2 MUST be treated as SW_SHOWNORMAL 841 #>60 lelong x ShowCommand=%#x 842 >60 lelong x 843 >>60 lelong 3 \bshowmaximized 844 >>60 lelong 7 \bshowminnoactive 845 >>60 default x \bnormal 846 # Hotkey 847 >64 uleshort >0 \b, hot key 848 # 41h~A 42h~B ... 849 >>64 ubyte x %c 850 # modifier keys: 0x01~HOTKEYF_SHIFT 0x02~HOTKEYF_CONTROL 0x04~HOTKEYF_ALT 851 >>65 ubyte&1 1 \b+SHIFT 852 >>65 ubyte&2 2 \b+CONTROL 853 >>65 ubyte&4 4 \b+ALT 854 # Reserved; MUST be zero 855 #>66 uleshort !0 \b, reserved %#x 856 # Reserved2; MUST be zero 857 #>68 ulelong !0 \b, reserved2 %#x 858 # Reserved3; MUST be zero 859 #>72 ulelong !0 \b, reserved3 %#x 860 # optional LINKTARGET_IDLIST if LinkFlags bit HasLinkTargetIDList is set 861 >20 lelong&1 1 862 # IDListSize; size of IDList 863 >>76 uleshort x \b, IDListSize %#4.4x 864 # 1st item 865 >>78 use lnk-item 866 # 2nd possible item 867 >>(78.s+78) uleshort >0 868 >>>(78.s+78) use lnk-item 869 # 3rd possible item 870 >>>&(&-2.s-2) uleshort >0 871 >>>>&-2 use lnk-item 872 # 4th possible item 873 >>>>&(&-2.s-2) uleshort >0 874 >>>>>&-2 use lnk-item 875 # Because HasLinkInfo is set, a LinkInfo structure follows 876 >20 lelong&2 2 877 # if no LINKTARGET_IDLIST (no HasLinkTargetIDList) then direct after header; no example found 878 >>20 lelong&1 =0 879 >>>76 use lnk-info 880 # if LINKTARGET_IDLIST (HasLinkTargetIDList) then after LINKTARGET_IDLIST by addtional IDListSize bytes 881 >>20 lelong&1 =1 882 >>>76 uleshort >0 883 #>>>>(76.s+78) use lnk-info 884 >>>>(76.s+78) ubelong x 885 # move pointer to beginnig of LinkInfo structure 886 >>>>>&-8 ubelong x 887 #>>>>>>&16 ulelong x \b, LocalBasePathOffset=%#8.8x 888 >>>>>>&(&16.l) string x \b, LocalBasePath "%s" 889 # check and then display link item (size,data) 890 0 name lnk-item 891 # size value 0x0000 means TerminalID; indicates the end of the item IDs list 892 >0 uleshort >0 893 #>>0 uleshort x \b, ItemIDSize %#4.4x 894 # item Data 895 #>>2 ubequad x \b, Item data=%#16.16llx 896 #>>2 ubyte x \b, Item type=%#x 897 >>2 ubyte =0x1f \b, Root folder 898 # like: "26EE0668-A00A-44D7-9371-BEB064C98683" Control Panel 899 # "20D04FE0-3AEA-1069-A2D8-08002B30309D" My Computer 900 # "871C5380-42A0-1069-A2EA-08002B30309D" Internet Explorer 901 >>>4 guid x "%s" 902 >>2 ubyte =0x2f \b, Volume 903 # like: "C:\" "D:\" 904 >>>3 string x "%s" 905 # Control panel category 906 #>>2 ubyte foo \b, Control panel category 907 # display LinkInfo structure (size,flags,offsets) 908 0 name lnk-info 909 # LinkInfoSize; size of the LinkInfo structure 910 >0 ulelong x \b, LinkInfoSize %#x 911 # LinkInfoHeaderSize; if 1C no optional fields; >=24 optional fields are specified 912 >4 ulelong x \b, LinkInfoHeaderSize %#x 913 # LinkInfoFlags; 914 #>8 ulelong x \b, LinkInfoFlags=%#x 915 >8 ulelong&1 1 \b, VolumeIDAndLocalBasePath 916 # VolumeIDOffset; location of the VolumeID field (VolumeIDSize DriveType DriveSerialNumber VolumeLabelOffset ... ) inside LinkInfo structure 917 >>12 ulelong x \b, VolumeIDOffset %#x 918 # LocalBasePathOffset; location of LocalBasePath field like "C:\test\a.txt" inside LinkInfo structure 919 >>16 ulelong x \b, LocalBasePathOffset %#x 920 # LocalBasePathOffsetUnicode; location of the LocalBasePathUnicode field inside LinkInfo structure 921 >>4 ulelong >23 922 >>>28 ulelong x \b, LocalBasePathOffsetUnicode %#x 923 >8 ulelong&2 2 \b, CommonNetworkRelativeLinkAndPathSuffix 924 # CommonNetworkRelativeLinkOffset; location of the CommonNetworkRelativeLink field inside LinkInfo structure 925 >>20 ulelong x \b, CommonNetworkRelativeLinkOffset %#x 926 # CommonPathSuffixOffset; location of CommonPathSuffix field 927 >24 ulelong x \b, CommonPathSuffixOffset %#x 928 # CommonPathSuffixOffsetUnicode; location of CommonPathSuffixUnicode field inside LinkInfo structure 929 >4 ulelong >23 930 >>32 ulelong x \b, CommonPathSuffixOffsetUnicode %#x 931 932 # Summary: Outlook Personal Folders 933 # Created by: unknown 934 # Update: Joerg Jenderek 935 # URL: http://fileformats.archiveteam.org/wiki/Personal_Folder_File 936 # https://en.wikipedia.org/wiki/Personal_Storage_Table 937 # Reference: https://interoperability.blob.core.windows.net/files/MS-PST/%5bMS-PST%5d.pdf 938 # http://mark0.net/download/triddefs_xml.7z/defs/p/pab.trid.xml 939 # dwMagic !BDN 940 0 lelong 0x4E444221 941 # skip DROID x-fmt-75-signature-id-472.pab x-fmt-248-signature-id-260.pst x-fmt-249-signature-id-261.pst 942 # by check for existance of bPlatformCreate value 943 >14 ubyte x Microsoft Outlook 944 #!:mime application/octet-stream 945 # NOT official registered ! 946 !:mime application/vnd.ms-outlook 947 # dwCRCPartial; 32-bit cyclic redundancy check (CRC) value of followin 471 bytes; zero for 64-bit 948 #>>4 ulelong !0 \b, CRC %#x 949 # wMagicClient; AB (4142h) is used for PAB files; SM (534Dh) is used for PST files; SO (534Fh) is used for OST files 950 #>>8 leshort x \b, wMagicClient=%#x 951 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/p/pab.trid.xml 952 # Note: called "Microsoft Personal Address Book" by TrID and 953 # "Microsoft Outlook Personal Address Book" by DROID via x-fmt/75 954 >>8 leshort 0x4142 Personal Address Book 955 #!:mime application/x-ms-pab 956 !:ext pab 957 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/p/pst.trid.xml 958 # http://mark0.net/download/triddefs_xml.7z/defs/p/pst-unicode.trid.xml 959 # Note: called "Microsoft OutLook Personal Folder" by TrID and 960 # by DROID via x-fmt/248 for ANSI and via x-fmt/249 for Unicode 961 #>>8 leshort 0x4D53 \b, PST~ 962 # called "Microsoft Outlook email folder" in ./windows version 1.37 and older 963 >>8 leshort 0x4D53 Personal Storage 964 #!:mime application/x-ms-pst 965 !:ext pst 966 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/o/ost.trid.xml 967 # Note: called "Outlook Exchange Offline Storage" by TrID 968 >>8 leshort 0x4F53 Offline Storage 969 #!:mime application/x-ms-ost 970 !:ext ost 971 # wVer; file format version. 14 or 15 if the file is ANSI; > 21 or 23(=17h) if Unicode; 37 for written by Outlook with WIP 972 >>10 uleshort x ( 973 # probably NO intermediate versions exist 974 >>10 leshort <0x10 \b<=2002, ANSI, 975 >>10 leshort >0x14 \b>=2003, Unicode, 976 >>10 uleshort x version %u) 977 # wVerClient; client file format version like: 19 22 978 #>>12 uleshort x \b, wVerClient=%u 979 # bPlatformCreate; This value MUST be set to 1 but also found 2 980 >>14 ubyte >1 \b, bPlatformCreate=%u 981 # bPlatformAccess; This value MUST be set to 1 but also found 2 982 >>15 ubyte >1 \b, bPlatformAccess=%u 983 # dwReserved1; SHOULD ignore and NOT modify this value; SHOULD initialize to zero 984 >>16 ulelong !0 \b, dwReserved1=%#x 985 # dwReserved2; SHOULD ignore and NOT modify this value; SHOULD initialize to zero 986 >>20 ulelong !0 \b, dwReserved2=%#x 987 # ANSI 32-bit variant Outlook 1997-2002 988 >>10 uleshort <16 989 # bidNextB; next BlockID (ANSI 4 bytes) 990 #>>>24 ulelong !0 \b, bidNextB=%#x 991 # bidNextP; Next available back BlockID pointer 992 #>>>28 ulelong !0 \b, bidNextP=%#x 993 # dwUnique; value monotonically increased when modifying PST; so CRC is changing 994 >>>32 ulelong !0 \b, dwUnique=%#x 995 # rgnid[128]; A fixed array of 32 NodeIDs, each corresponding to one of the 32 possible NID_TYPEs 996 #>>>36 ubequad x \b, rgnid=%#llx... 997 # dwReserved; Implementations SHOULD ignore this value and SHOULD NOT modify it; Initialized zero 998 >>>164 ulelong !0 \b, dwReserved=%#x 999 # ibFileEof; the size of the PST file, in bytes (ANSI 4 bytes) 1000 >>>168 ulelong x \b, %u bytes 1001 # ibAMapLast; offset to the last AMap page 1002 #>>>172 ulelong x \b, ibAMapLast=%#x 1003 # bSentinel; MUST be set to 0x80 1004 >>>460 ubyte !0x80 \b, bSentinel=%#x 1005 # bCryptMethod: 0~No encryption 1~encryption with permutation 2~encryption with cyclic 16~encryption with Windows Information Protection (WIP) 1006 >>>461 ubyte >0 \b, bCryptMethod=%u 1007 # UNICODE 64-bit variant Outlook 2003-2007 1008 >>10 uleshort >20 1009 # bidUnused; Unused 8 bytes padding (Unicode only); sometimes like: 0x0000000100000004 1010 >>>24 ulequad !0x0000000100000004 \b, bidUnused=%#16.16llx 1011 # dwUnique; value monotonically increased when modifying PST; so CRC is changing 1012 >>>40 ulelong !0 \b, dwUnique=%#x 1013 # rgnid[] (128 bytes): A fixed array of 32 NIDs, each corresponding to one of the 32 possible 1014 #>>>44 ubequad x \b, rgnid=%#llx... 1015 # ibFileEof; the size of the PST file, in bytes (Unicode 8 bytes) 1016 >>>184 ulequad x \b, %llu bytes 1017 # bSentinel; MUST be set to 0x80 1018 >>>512 ubyte !0x80 \b, bSentinel=%#x 1019 # bCryptMethod; Encryption type like: 0 1 2 16 1020 >>>513 ubyte >0 \b, bCryptMethod=%u 1021 # dwCRC; 32-bit CRC of the of the previous 516 bytes 1022 >>>524 ulelong x \b, CRC32 %#x 1023 1024 1025 # Summary: Windows help cache 1026 # Created by: unknown 1027 0 string \164\146\115\122\012\000\000\000\001\000\000\000 MS Windows help cache 1028 1029 1030 # Summary: IE cache file 1031 # Created by: Christophe Monniez 1032 0 string Client\ UrlCache\ MMF Internet Explorer cache file 1033 >20 string >\0 version %s 1034 1035 1036 # Summary: Registry files 1037 # Created by: unknown 1038 # Modified by (1): Joerg Jenderek 1039 0 string regf MS Windows registry file, NT/2000 or above 1040 0 string CREG MS Windows 95/98/ME registry file 1041 0 string SHCC3 MS Windows 3.1 registry file 1042 1043 1044 # Summary: Windows Registry text 1045 # URL: https://en.wikipedia.org/wiki/Windows_Registry#.REG_files 1046 # Reference: http://fileformats.archiveteam.org/wiki/Windows_Registry 1047 # Submitted by: Abel Cheung <abelcheung (a] gmail.com> 1048 # Update: Joerg Jenderek 1049 # Windows 3-9X variant 1050 0 string REGEDIT 1051 # skip ASCII text like "REGEDITor.txt" but match 1052 # L1WMAP.REG with only 1 CRNL or org.gnome.gnumeric.reg with 2 NL 1053 >7 search/3 \n Windows Registry text 1054 !:mime text/x-ms-regedit 1055 !:ext reg 1056 # Windows 9X variant 1057 >>0 string REGEDIT4 (Win95 or above) 1058 # Windows 2K ANSI variant 1059 0 string Windows\ Registry\ Editor\ 1060 >&0 string Version\ 5.00\r\n\r\n Windows Registry text (Win2K or above) 1061 !:mime text/x-ms-regedit 1062 !:ext reg 1063 # Windows 2K UTF-16 variant 1064 2 lestring16 Windows\ Registry\ Editor\ 1065 >0x32 lestring16 Version\ 5.00\r\n\r\n Windows Registry little-endian text (Win2K or above) 1066 # relative offset not working 1067 #>&0 lestring16 Version\ 5.00\r\n\r\n Windows Registry little-endian text (Win2K or above) 1068 !:mime text/x-ms-regedit 1069 !:ext reg 1070 # WINE variant 1071 # URL: https://en.wikipedia.org/wiki/Wine_(software) 1072 # Reference: https://www.winehq.org/pipermail/wine-cvs/2005-October/018763.html 1073 # Note: WINE use text based registry (system.reg,user.reg,userdef.reg) 1074 # instead binary hiv structure like Windows 1075 0 string WINE\ REGISTRY\ Version\ WINE registry text 1076 # version 2 1077 >&0 string x \b, version %s 1078 !:mime text/x-wine-extension-reg 1079 !:ext reg 1080 1081 # Windows *.INF *.INI files updated by Joerg Jenderek at Apr 2013, Feb 2018 1082 # empty ,comment , section 1083 # PR/383: remove unicode BOM because it is not portable across regex impls 1084 #0 regex/s \\`(\\r\\n|;|[[]) 1085 # empty line CRLF 1086 0 ubeshort 0x0D0A 1087 >0 use ini-file 1088 # comment line starting with semicolon 1089 0 string ; 1090 # look for phrase of Windows policy ADMinistrative template (with starting remark) 1091 # like: WINDOW_95_CD/TOOLS/RESKIT/netadmin/poledit/conf.adm 1092 >1 search/3548 END\040CATEGORY 1093 # ADM with remark (by adm-rem.trid.xml) already done by generic ASCII variant 1094 # if no Windows policy ADMinistrative template then Windows INItialization 1095 >1 default x 1096 >>0 use ini-file 1097 # section line starting with left bracket 1098 0 string [ 1099 >0 use ini-file 1100 # check and then display Windows INItialization configuration 1101 0 name ini-file 1102 # look for left bracket in section line 1103 >0 search/8192 [ 1104 # https://en.wikipedia.org/wiki/Autorun.inf 1105 # https://msdn.microsoft.com/en-us/library/windows/desktop/cc144200.aspx 1106 # space after right bracket 1107 # or AutoRun.Amd64 for 64 bit systems 1108 # or only NL separator 1109 >>&0 regex/c \^autorun 1110 # but sometimes total commander directory tree file "treeinfo.wc" with lines like 1111 # [AUTORUN] 1112 # [boot] 1113 >>>&0 string =]\r\n[ Total commander directory treeinfo.wc 1114 !:mime text/plain 1115 !:ext wc 1116 # From: Pal Tamas <folti (a] balabit.hu> 1117 # Autorun File 1118 >>>&0 string !]\r\n[ Microsoft Windows Autorun file 1119 !:mime application/x-setupscript 1120 !:ext inf 1121 # https://msdn.microsoft.com/en-us/library/windows/hardware/ff549520(v=vs.85).aspx 1122 # version strings ASCII coded case-independent for Windows setup information script file 1123 >>&0 regex/c \^(version|strings)] Windows setup INFormation 1124 !:mime application/x-setupscript 1125 #!:mime application/x-wine-extension-inf 1126 !:ext inf 1127 # NETCRC.INF OEMCPL.INF 1128 >>&0 regex/c \^(WinsockCRCList|OEMCPL)] Windows setup INFormation 1129 !:mime application/x-setupscript 1130 !:ext inf 1131 # http://www.winfaq.de/faq_html/Content/tip2500/onlinefaq.php?h=tip2653.htm 1132 # https://msdn.microsoft.com/en-us/library/windows/desktop/cc144102.aspx 1133 # .ShellClassInfo DeleteOnCopy LocalizedFileNames ASCII coded case-independent 1134 >>&0 regex/1024c \^(\\.ShellClassInfo|DeleteOnCopy|LocalizedFileNames)] Windows desktop.ini 1135 !:mime application/x-wine-extension-ini 1136 #!:mime text/plain 1137 # https://support.microsoft.com/kb/84709/ 1138 >>&0 regex/c \^don't\ load] Windows CONTROL.INI 1139 !:mime application/x-wine-extension-ini 1140 !:ext ini 1141 >>&0 regex/c \^(ndishlp\\$|protman\\$|NETBEUI\\$)] Windows PROTOCOL.INI 1142 !:mime application/x-wine-extension-ini 1143 !:ext ini 1144 # https://technet.microsoft.com/en-us/library/cc722567.aspx 1145 # http://www.winfaq.de/faq_html/Content/tip0000/onlinefaq.php?h=tip0137.htm 1146 >>&0 regex/c \^(windows|Compatibility|embedding)] Windows WIN.INI 1147 !:mime application/x-wine-extension-ini 1148 !:ext ini 1149 # https://en.wikipedia.org/wiki/SYSTEM.INI 1150 >>&0 regex/c \^(boot|386enh|drivers)] Windows SYSTEM.INI 1151 !:mime application/x-wine-extension-ini 1152 !:ext ini 1153 # http://www.mdgx.com/newtip6.htm 1154 >>&0 regex/c \^SafeList] Windows IOS.INI 1155 !:mime application/x-wine-extension-ini 1156 !:ext ini 1157 # https://en.wikipedia.org/wiki/NTLDR Windows Boot Loader information 1158 >>&0 regex/c \^boot\x20loader] Windows boot.ini 1159 !:mime application/x-wine-extension-ini 1160 !:ext ini 1161 # https://en.wikipedia.org/wiki/CONFIG.SYS 1162 >>&0 regex/c \^menu] MS-DOS CONFIG.SYS 1163 # @CONFIG.UI configuration file of previous DOS version saved by Caldera OPENDOS INSTALL.EXE 1164 # CONFIG.PSS saved version of file CONFIG.SYS created by %WINDIR%\SYSTEM\MSCONFIG.EXE 1165 # CONFIG.TSH renamed file CONFIG.SYS.BAT by %WINDIR%\SYSTEM\MSCONFIG.EXE 1166 # dos and w40 used in dual booting scene 1167 !:ext sys/dos/w40 1168 # https://support.microsoft.com/kb/118579/ 1169 >>&0 regex/c \^Paths]\r\n MS-DOS MSDOS.SYS 1170 !:ext sys/dos 1171 # http://chmspec.nongnu.org/latest/INI.html#HHP 1172 >>&0 regex/c \^options]\r\n Microsoft HTML Help Project 1173 !:mime text/plain 1174 !:ext hhp 1175 # From: Joerg Jenderek 1176 # URL: https://documentation.basis.com/BASISHelp/WebHelp/b3odbc/ODBC_Driver/obdcdriv_character_translation.htm 1177 # Reference: https://www.garykessler.net/library/file_sigs.html 1178 # http://mark0.net/download/triddefs_xml.7z/defs/c/cpx.trid.xml 1179 # Note: stored in directory %WINDIR%\SysWOW64 or %WINDIR%\system 1180 # second word often Latin but sometimes Cyrillic like in 12510866.CPX 1181 >>&0 regex/c \^Windows\ (Latin|Cyrillic) Windows codepage translator 1182 #!:mime text/plain 1183 !:mime text/x-ms-cpx 1184 # like: 12510866.CPX 1185 !:ext cpx 1186 # From: Joerg Jenderek 1187 # URL: https://en.wikipedia.org/wiki/File_Explorer 1188 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/s/scf-exp.trid.xml,scf-exp-old.trid.xml 1189 # Note: called "Windows Explorer Command Shell File" by TrID and "File Explorer Command" by Windows via SHCmdFile 1190 >>&0 regex/c \^Shell]\r\n Windows Explorer Shell Command File 1191 #!:mime text/plain 1192 !:mime text/x-ms-scf 1193 # like: channels.scf desktop.scf explorer.scf "Desktop anzeigen.scf" 1194 !:ext scf 1195 # look for icon file directive maybe pointing to malicious file 1196 >>>1 search/128 IconFile= \b, icon 1197 >>>>&0 string x "%s" 1198 # From: Joerg Jenderek 1199 # URL: http://en.wikipedia.org/wiki/VIA_Technologies 1200 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/s/scf-via.trid.xml 1201 # Note: called "VIA setup configuration file" by TrID 1202 >>&0 regex/c \^SCF]\r\n VIA setup configuration 1203 #!:mime text/plain 1204 !:mime text/x-via-scf 1205 # like: SETUP.SCF 1206 !:ext scf 1207 # From: Joerg Jenderek 1208 # URL: https://en.wikipedia.org/wiki/InstallShield 1209 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/l/lid-is.trid.xml 1210 # Note: contain also 3 keywords like: count Default key0 1211 >>&0 regex/c \^Languages] InstallShield Language Identifier 1212 #!:mime text/plain 1213 !:mime text/x-installshield-lid 1214 # like: SETUP.LID 1215 !:ext lid 1216 # From: Joerg Jenderek 1217 # URL: https://www.file-extensions.org/tag-file-extension 1218 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/t/taginfo.trid.xml 1219 # Note: contain also keywords like: Application Category Company Misc Version 1220 >>&0 regex/c \^TagInfo] TagInfo 1221 #!:mime text/plain 1222 #!:mime text/prs.lines.tag 1223 !:mime text/x-ms-tag 1224 # like: DATA.TAG 1225 !:ext tag 1226 # URL: https://en.wikipedia.org/wiki/Flatpak 1227 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/f/flatpakref.trid.xml 1228 # Note: called "Flatpack Reference" by TrID 1229 >>&0 string Flatpak\ Ref] Flatpak repository reference 1230 #!:mime text/plain 1231 # https://reposcope.com/mimetype/application/vnd.flatpak.ref 1232 !:mime application/vnd.flatpak.ref 1233 !:ext flatpakref 1234 # From: Joerg Jenderek 1235 # URL: https://en.wikipedia.org/wiki/CloneCD 1236 # Reference: https://en.wikipedia.org/wiki/CloneCD_Control_File 1237 # http://mark0.net/download/triddefs_xml.7z/defs/c/cdimage-clonecd-cue.trid.xml 1238 # Note: called "CloneCD CDImage (description)" by TrID and "CloneCD Control File" by DROID via PUID fmt/1760 1239 >>&0 string CloneCD] CloneCD CD-image Description 1240 #!:mime text/plain 1241 !:mime text/x-ccd 1242 !:ext ccd 1243 # unknown keyword after opening bracket 1244 >>&0 default x 1245 #>>>&0 string/c x UNKNOWN [%s 1246 # look for left bracket of second section 1247 >>>&0 search/8192 [ 1248 # version Strings FileIdentification 1249 >>>>&0 string/c version Windows setup INFormation 1250 !:mime application/x-setupscript 1251 !:ext inf 1252 # From: Joerg Jenderek 1253 # URL: https://cdrtfe.sourceforge.io/ 1254 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/c/cfp-cdrtfe.trid.xml 1255 >>>>&0 string FileExplorer] cdrtfe Project 1256 !:mime text/x-cfp 1257 !:ext cfp 1258 # https://en.wikipedia.org/wiki/Initialization_file Windows Initialization File or other 1259 >>>>&0 default x 1260 >>>>>&0 ubyte x 1261 # characters, digits, underscore and white space followed by right bracket 1262 # terminated by CR implies section line to skip BOOTLOG.TXT DETLOG.TXT 1263 >>>>>>&-1 regex/T \^([A-Za-z0-9_\(\)\ ]+)\]\r Generic INItialization configuration [%-.40s 1264 # NETDEF.INF multiarc.ini 1265 #!:mime application/x-setupscript 1266 !:mime application/x-wine-extension-ini 1267 #!:mime text/plain 1268 !:ext ini/inf 1269 # samples with only 1 and unknown section name 1270 # XXX: matches a file containing '[1] 2' 1271 #>>>&0 default x Generic INItialization configuration 1272 #>>>>0 string x \b, 1st line "%s" 1273 # UTF-16 BOM 1274 0 ubeshort =0xFFFE 1275 # look for phrase of Windows policy ADMinistrative template (UTF-16 by adm-uni.trid.xml) 1276 # like: wuau.adm 1277 >2 search/0x384A E\0N\0D\0\040\0C\0A\0T\0E\0G\0O\0R\0Y\0 1278 >>0 use windows-adm 1279 # if no Windows policy ADMinistrative template then Windows INFormation 1280 >2 default x 1281 # UTF-16 BOM followed by CR~0D00 , comment~semicolon~3B00 , section~bracket~5B00 1282 >>0 ubelong&0xFFff89FF =0xFFFE0900 1283 # look for left bracket in section line 1284 >>>2 search/8192 [ 1285 # keyword without 1st letter which is maybe up-/down-case 1286 >>>>&3 lestring16 ersion] Windows setup INFormation 1287 !:mime application/x-setupscript 1288 # like: hdaudio.inf iscsi.inf spaceport.inf tpm.inf usbhub3.inf UVncVirtualDisplay.inf 1289 !:ext inf 1290 >>>>&3 lestring16 trings] Windows setup INFormation 1291 !:mime application/x-setupscript 1292 # like: arduino_gemma.inf iis.inf MSM8960.inf 1293 !:ext inf 1294 >>>>&3 lestring16 ourceDisksNames] Windows setup INFormation 1295 !:mime application/x-setupscript 1296 # like: atiixpag.inf mdmnokia.inf netefe32.inf rdpbus.inf 1297 !:ext inf 1298 # netnwcli.inf start with ;---[ NetNWCli.INX ] 1299 >>>>&3 default x 1300 # look for NL followed by left bracket 1301 >>>>>&0 search/8192 \x0A\x00\x5b 1302 # like: defltwk.inf netvwifibus.inf WSDPrint.inf 1303 >>>>>>&3 lestring16 ersion] Windows setup INFormation 1304 !:mime application/x-setupscript 1305 !:ext inf 1306 1307 # Summary: Windows Policy ADMinistrative template 1308 # From: Joerg Jenderek 1309 # URL: https://en.wikipedia.org/wiki/Administrative_Template 1310 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/a/adm.trid.xml 1311 # Note: typically stored in directory like: %WINDIR%\system32\GroupPolicy\ADM 1312 # worst case ASCII variant starting with remark line like: inetset.adm 1313 0 search/0x4E CLASS\040 1314 >&0 string MACHINE 1315 >>0 use windows-adm 1316 >&0 string USER 1317 >>0 use windows-adm 1318 # display information about Windows policy ADMinistrative template 1319 0 name windows-adm Windows Policy Administrative Template 1320 !:mime text/x-ms-adm 1321 !:ext adm 1322 # UTF-16 BOM implies UTF-16 encoded ADM (by adm-uni.trid.xml) 1323 >0 ubeshort =0xFFFE 1324 >>2 lestring16 x \b, 1st line "%s" 1325 # look for UTF-16 encoded CarriageReturn LineFeed 1326 >>>2 search/0x3A \r\0\n\0 1327 >>>>&0 lestring16 x \b, 2nd line "%s" 1328 # no UTF-16 BOM implies "ASCII" encoded ADM (by adm.trid.xml) 1329 >0 ubeshort !0xFFFE 1330 >>0 string x \b, 1st line "%s" 1331 #>>>&0 ubequad x \b, 2ND %16.16llx 1332 # 2nd line empty 1333 >>>&2 beshort =0x0D0A 1334 >>>>&0 beshort !0x0D0A \b, 3th line 1335 >>>>>&-2 string x "%s" 1336 # 2nd line with content 1337 >>>&2 beshort !0x0D0A \b, 2nd line 1338 >>>>&-2 string x "%s" 1339 1340 # Windows Precompiled INF files *.PNF added by Joerg Jenderek at Mar 2013 of _PNF_HEADER inf.h 1341 # http://read.pudn.com/downloads3/sourcecode/windows/248345/win2k/private/windows/setup/setupapi/inf.h__.htm 1342 # URL: http://fileformats.archiveteam.org/wiki/INF_(Windows) 1343 # Reference: http://en.verysource.com/code/10350344_1/inf.h.html 1344 # Note: stored in %Windir%\Inf %Windir%\System32\DriverStore\FileRepository 1345 # check for valid major and minor versions: 101h - 303h 1346 0 leshort&0xFcFc =0x0000 1347 # GRR: line above (strength 50) is too general as it catches also "PDP-11 UNIX/RT ldp" ./pdp 1348 >0 leshort&0x0303 !0x0000 1349 # test for valid InfStyles: 1 2 1350 >>2 uleshort >0 1351 >>>2 uleshort <3 1352 # look for colon in WinDirPath after PNF header 1353 #>>>>0x59 search/18 : 1354 # skip few Adobe Photoshop Color swatch ("Mac OS.aco" TRUMATCH-Farben.aco Windows.aco) and some 1355 # Targa image (money-256.tga XING_B_UCM8.tga x-fmt-367-signature-id-604.tga) with "invalid low section name" \0 1356 >>>>(20.l) ubelong >0x40004000 1357 >>>>>0 use PreCompiledInf 1358 0 name PreCompiledInf 1359 >0 uleshort x Windows Precompiled iNF 1360 !:mime application/x-pnf 1361 !:ext pnf 1362 # major version 1 for older Windows like XP and 3 since about Windows Vista 1363 # 101h~95-XP; 301h~Windows Vista-7 ; 302h~Windows 10 14393; 303h~Windows 10 18362-Windows11 1364 >1 ubyte x \b, version %u 1365 >0 ubyte x \b.%u 1366 >0 uleshort =0x0101 (Windows 1367 >>4 ulelong&0x00000001 !0x00000001 95-98) 1368 >>4 ulelong&0x00000001 =0x00000001 XP) 1369 >0 uleshort =0x0301 (Windows Vista-8.1) 1370 >0 uleshort =0x0302 (Windows 10 older) 1371 >0 uleshort =0x0303 (Windows 10-11) 1372 # 1 ,2 (windows 98 SE) 1373 >2 uleshort !2 \b, InfStyle %u 1374 # PNF_FLAG_IS_UNICODE 0x00000001 1375 # PNF_FLAG_HAS_STRINGS 0x00000002 1376 # PNF_FLAG_SRCPATH_IS_URL 0x00000004 1377 # PNF_FLAG_HAS_VOLATILE_DIRIDS 0x00000008 1378 # PNF_FLAG_INF_VERIFIED 0x00000010 1379 # PNF_FLAG_INF_DIGITALLY_SIGNED 0x00000020 1380 # UNKNOWN8 0x00000080 1381 # UNKNOWN 0x00000100 1382 # UNKNOWN1 0x01000000 1383 # UNKNOWN2 0x02000000 1384 >4 ulelong&0x03000180 >0 \b, flags 1385 >>4 ulelong x %#x 1386 >4 ulelong&0x00000001 0x00000001 \b, unicoded 1387 >4 ulelong&0x00000002 0x00000002 \b, has strings 1388 >4 ulelong&0x00000004 0x00000004 \b, src URL 1389 >4 ulelong&0x00000008 0x00000008 \b, volatile dir ids 1390 >4 ulelong&0x00000010 0x00000010 \b, verified 1391 >4 ulelong&0x00000020 0x00000020 \b, digitally signed 1392 # >4 ulelong&0x00000080 0x00000080 \b, UNKNOWN8 1393 # >4 ulelong&0x00000100 0x00000100 \b, UNKNOWN 1394 # >4 ulelong&0x01000000 0x01000000 \b, UNKNOWN1 1395 # >4 ulelong&0x02000000 0x02000000 \b, UNKNOWN2 1396 #>8 ulelong x \b, InfSubstValueListOffset %#x 1397 # many 0, 1 lmouusb.PNF, 2 linkfx10.PNF , f webfdr16.PNF 1398 # , 6 bth.PNF, 9 usbport.PNF, d netnwifi.PNF, 10h nettcpip.PNF 1399 #>12 uleshort x \b, InfSubstValueCount %#x 1400 # only < 9 found: 8 hcw85b64.PNF 1401 #>14 uleshort x \b, InfVersionDatumCount %#x 1402 # only found values lower 0x0000ffff ?? 1403 #>16 ulelong x \b, InfVersionDataSize %#x 1404 # only found positive values lower 0x00ffFFff for InfVersionDataOffset 1405 >20 ulelong x \b, at %#x 1406 >4 ulelong&0x00000001 =0x00000001 1407 # case independent: CatalogFile Class DriverVer layoutfile LayoutFile SetupClass signature Signature 1408 >>(20.l) lestring16 x "%s" 1409 >4 ulelong&0x00000001 !0x00000001 1410 >>(20.l) string x "%s" 1411 # FILETIME is number of 100-nanosecond intervals since 1 January 1601 1412 #>24 ulequad x \b, InfVersionLastWriteTime %16.16llx 1413 >24 qwdate x \b, InfVersionLastWriteTime %s 1414 # for Windows 98, XP 1415 >0 uleshort <0x0102 1416 # only found values lower 0x00ffFFff 1417 # often 70 but also 78h for corelist.PNF 1418 # >>32 ulelong x \b, StringTableBlockOffset %#x 1419 # >>36 ulelong x \b, StringTableBlockSize %#x 1420 # >>40 ulelong x \b, InfSectionCount %#x 1421 # >>44 ulelong x \b, InfSectionBlockOffset %#x 1422 # >>48 ulelong x \b, InfSectionBlockSize %#x 1423 # >>52 ulelong x \b, InfLineBlockOffset %#x 1424 # >>56 ulelong x \b, InfLineBlockSize %#x 1425 # >>60 ulelong x \b, InfValueBlockOffset %#x 1426 # >>64 ulelong x \b, InfValueBlockSize %#x 1427 # WinDirPathOffset 1428 # like 58h, which means direct after PNF header 1429 #>>68 ulelong x \b, at %#x 1430 >>68 ulelong x 1431 >>>4 ulelong&0x00000001 =0x00000001 1432 #>>>>(68.l) ubequad =0x43003a005c005700 1433 # normally unicoded C:\Windows 1434 #>>>>>(68.l) lestring16 x \b, WinDirPath "%s" 1435 >>>>(68.l) ubequad !0x43003a005c005700 1436 >>>>>(68.l) lestring16 x \b, WinDirPath "%s" 1437 >>>4 ulelong&0x00000001 !0x00000001 1438 # normally ASCII C:\WINDOWS 1439 #>>>>(68.l) string =C:\\WINDOWS \b, WinDirPath "%s" 1440 >>>>(68.l) string !C:\\WINDOWS 1441 >>>>>(68.l) string x \b, WinDirPath "%s" 1442 # found OsLoaderPathOffset values often 0 , once 70h corelist.PNF, once 68h ASCII machine.PNF 1443 >>>72 ulelong >0 \b, 1444 >>>>4 ulelong&0x00000001 =0x00000001 1445 >>>>>(72.l) lestring16 x OsLoaderPath "%s" 1446 >>>>4 ulelong&0x00000001 !0x00000001 1447 # seldom C:\ instead empty 1448 >>>>>(72.l) string x OsLoaderPath "%s" 1449 # 1fdh 1450 #>>>76 uleshort x \b, StringTableHashBucketCount %#x 1451 # https://docs.microsoft.com/en-us/openspecs/office_standards/ms-oe376/6c085406-a698-4e12-9d4d-c3b0ee3dbc4a 1452 # only 407h found 1453 >>>78 uleshort !0x409 \b, LanguageID %x 1454 #>>>78 uleshort =0x409 \b, LanguageID %x 1455 # InfSourcePathOffset often 0 1456 >>>80 ulelong >0 \b, at %#x 1457 >>>>4 ulelong&0x00000001 =0x00000001 1458 >>>>>(80.l) lestring16 x SourcePath "%s" 1459 >>>>4 ulelong&0x00000001 !0x00000001 1460 >>>>>(80.l) string >\0 SourcePath "%s" 1461 # OriginalInfNameOffset often 0 1462 >>>84 ulelong >0 \b, at %#x 1463 >>>>4 ulelong&0x00000001 =0x00000001 1464 >>>>>(84.l) lestring16 x InfName "%s" 1465 >>>>4 ulelong&0x00000001 !0x00000001 1466 >>>>>(84.l) string >\0 InfName "%s" 1467 1468 # for newer Windows like Vista, 7 , 8.1 , 10 1469 >0 uleshort >0x0101 1470 >>80 ulelong x \b, at %#x WinDirPath 1471 >>>4 ulelong&0x00000001 0x00000001 1472 # normally unicoded C:\Windows 1473 #>>>>(80.l) ubequad =0x43003a005c005700 1474 #>>>>>(80.l) lestring16 x "%s" 1475 >>>>(80.l) ubequad !0x43003a005c005700 1476 >>>>>(80.l) lestring16 x "%s" 1477 # language id: 0 407h~german 409h~English_US 1478 >>90 uleshort !0x409 \b, LanguageID %x 1479 #>>90 uleshort =0x409 \b, LanguageID %x 1480 >>92 ulelong >0 \b, at %#x 1481 >>>4 ulelong&0x00000001 0x00000001 1482 # language string like: de-DE en-US 1483 >>>>(92.l) lestring16 x language %s 1484 1485 # Summary: backup file created with utility like NTBACKUP.EXE shipped with Windows NT/2K/XP/2003 1486 # Extension: .bkf 1487 # Created by: Joerg Jenderek 1488 # URL: https://en.wikipedia.org/wiki/NTBackup 1489 # Reference: http://laytongraphics.com/mtf/MTF_100a.PDF 1490 # Descriptor BloCK name of Microsoft Tape Format 1491 0 string TAPE 1492 # Format Logical Address is zero 1493 >20 ulequad 0 1494 # Reserved for MBC is zero 1495 >>28 uleshort 0 1496 # Control Block ID is zero 1497 >>>36 ulelong 0 1498 # BIT4-BIT15, BIT18-BIT31 of block attributes are unused 1499 >>>>4 ulelong&0xFFfcFFe0 0 Windows NTbackup archive 1500 #!:mime application/x-ntbackup 1501 !:ext bkf 1502 # OS ID 1503 >>>>>10 ubyte 1 \b NetWare 1504 >>>>>10 ubyte 13 \b NetWare SMS 1505 >>>>>10 ubyte 14 \b NT 1506 >>>>>10 ubyte 24 \b 3 1507 >>>>>10 ubyte 25 \b OS/2 1508 >>>>>10 ubyte 26 \b 95 1509 >>>>>10 ubyte 27 \b Macintosh 1510 >>>>>10 ubyte 28 \b UNIX 1511 # OS Version (2) 1512 #>>>>>11 ubyte x OS V=%x 1513 # MTF_CONTINUATION Media Sequence Number > 1 1514 #>>>>>4 ulelong&0x00000001 !0 \b, continued 1515 # MTF_COMPRESSION 1516 >>>>>4 ulelong&0x00000004 !0 \b, compressed 1517 # MTF_EOS_AT_EOM End Of Medium was hit during end of set processing 1518 >>>>>4 ulelong&0x00000008 !0 \b, End Of Medium hit 1519 >>>>>4 ulelong&0x00020000 0 1520 # MTF_SET_MAP_EXISTS A Media Based Catalog Set Map may exist on tape 1521 >>>>>>4 ulelong&0x00010000 !0 \b, with catalog 1522 # MTF_FDD_ALLOWED However File/Directory Detail can only exist if a Set Map is also present 1523 >>>>>4 ulelong&0x00020000 !0 \b, with file catalog 1524 # Offset To First Event 238h,240h,28Ch 1525 #>>>>>8 uleshort x \b, event offset %4.4x 1526 # Displayable Size (20e0230h 20e024ch 20e0224h) 1527 #>>>>>8 ulequad x dis. size %16.16llx 1528 # Media Family ID (455288C4h 4570BD1Ah 45708F2Fh 4570BBF5h) 1529 #>>>>>52 ulelong x family ID %8.8x 1530 # TAPE Attributes (3) 1531 #>>>>>56 ulelong x TAPE %8.8x 1532 # Media Sequence Number 1533 >>>>>60 uleshort >1 \b, sequence %u 1534 # Password Encryption Algorithm (3) 1535 >>>>>62 uleshort >0 \b, %#x encrypted 1536 # Soft Filemark Block Size * 512 (2) 1537 #>>>>>64 uleshort =2 \b, soft size %u*512 1538 >>>>>64 uleshort !2 \b, soft size %u*512 1539 # Media Based Catalog Type (1,2) 1540 #>>>>>66 uleshort x \b, catalog type %4.4x 1541 # size of Media Name (66,68,6Eh) 1542 >>>>>68 uleshort >0 1543 # offset of Media Name (5Eh) 1544 >>>>>>70 uleshort >0 1545 # 0~, 1~ANSI, 2~UNICODE 1546 >>>>>>>48 ubyte 1 1547 # size terminated ansi coded string normally followed by "MTF Media Label" 1548 >>>>>>>>(70.s) string >\0 \b, name: %s 1549 >>>>>>>48 ubyte 2 1550 # Not null, but size terminated unicoded string 1551 >>>>>>>>(70.s) lestring16 x \b, name: %s 1552 # size of Media Label (104h) 1553 #>>>>>72 uleshort >0 1554 # offset of Media Label (C4h,C6h,CCh) 1555 >>>>>74 uleshort >0 1556 >>>>>>48 ubyte 1 1557 #Tag|Version|Vendor|Vendor ID|Creation Time Stamp|Cartridge Label|Side|Media ID|Media Domain ID|Vendor Specific fields 1558 >>>>>>>(74.s) string >\0 \b, label: %s 1559 >>>>>>48 ubyte 2 1560 >>>>>>>(74.s) lestring16 x \b, label: %s 1561 # size of password name (0,1Ch) 1562 #>>>>>76 uleshort >0 \b, password size %4.4x 1563 # Software Vendor ID (CBEh) 1564 >>>>>86 uleshort x \b, software (%#x) 1565 # size of Software Name (6Eh) 1566 >>>>>80 uleshort >0 1567 # offset of Software Name (1C8h,1CAh,1D0h) 1568 >>>>>>82 uleshort >0 1569 # 1~ANSI, 2~UNICODE 1570 >>>>>>>48 ubyte 1 1571 >>>>>>>>(82.s) string >\0 \b: %s 1572 >>>>>>>48 ubyte 2 1573 # size terminated unicoded coded string normally followed by "SPAD" 1574 >>>>>>>>(82.s) lestring16 x \b: %s 1575 # Format Logical Block Size (512,1024) 1576 #>>>>>84 uleshort =1024 \b, block size %u 1577 >>>>>84 uleshort !1024 \b, block size %u 1578 # Media Date of MTF_DATE_TIME type with 5 bytes 1579 #>>>>>>88 ubequad x DATE %16.16llx 1580 # MTF Major Version (1) 1581 #>>>>>>93 ubyte x \b, MFT version %x 1582 # 1583 1584 # URL: https://en.wikipedia.org/wiki/PaintShop_Pro 1585 # Reference: https://www.cryer.co.uk/file-types/p/pal.htm 1586 # Created by: Joerg Jenderek 1587 # Note: there exist other color palette formats also with .pal extension 1588 0 string JASC-PAL\r\n PaintShop Pro color palette 1589 #!:mime text/plain 1590 # PspPalette extension is used by newer (probably 8) PaintShopPro versions 1591 !:ext pal/PspPalette 1592 # 2nd line contains palette file version. For example "0100" 1593 >10 string !0100 \b, version %.4s 1594 # third line contains the number of colours: 16 256 ... 1595 >16 string x \b, %.3s colors 1596 1597 # URL: https://en.wikipedia.org/wiki/Innosetup 1598 # Reference: https://github.com/jrsoftware/issrc/blob/master/Projects/Undo.pas 1599 # Created by: Joerg Jenderek 1600 # Note: created by like "InnoSetup self-extracting archive" inside ./msdos 1601 # TrID labeles the entry as "Inno Setup Uninstall Log" 1602 # TUninstallLogID 1603 0 string Inno\ Setup\ Uninstall\ Log\ (b) InnoSetup Log 1604 !:mime application/x-innosetup 1605 # unins000.dat, unins001.dat, ... 1606 !:ext dat 1607 # " 64-bit" variant 1608 >0x1c string >\0 \b%.7s 1609 # AppName[0x80] like "Minimal SYStem", ClamWin Free Antivirus , ... 1610 >0xc0 string x %s 1611 # AppId[0x80] is similar to AppName or 1612 # GUID like {4BB0DCDC-BC24-49EC-8937-72956C33A470} start with left brace 1613 >0x40 ubyte 0x7b 1614 >>0x40 string x %-.38s 1615 # do not know how this log version correlates to program version 1616 >0x140 ulelong x \b, version %#x 1617 # NumRecs 1618 #>0x144 ulelong x \b, %#4.4x records 1619 # EndOffset means files size 1620 >0x148 ulelong x \b, %u bytes 1621 # Flags 5 25h 35h 1622 #>0x14c ulelong x \b, flags %8.8x 1623 # Reserved: array[0..26] of Longint 1624 # the non Unicode HighestSupportedVersion may never become greater than or equal to 1000 1625 >0x140 ulelong <1000 1626 # hostname 1627 >>0x1d6 pstring x \b, %s 1628 # user name 1629 >>>&0 pstring x \b\%s 1630 # directory like C:\Program Files (x86)\GnuWin32 1631 >>>>&0 pstring x \b, "%s" 1632 # version 1000 or higher implies unicode 1633 >0x140 ulelong >999 1634 # hostname 1635 >>0x1db lestring16 x \b, %-.9s 1636 # utf string variant with prepending fe??ffFFff 1637 >>0x1db search/43 \xFF\xFF\xFF 1638 # user name 1639 >>>&0 lestring16 x \b\%-.9s 1640 >>>&0 search/43 \xFF\xFF\xFF 1641 # directory like C:\Program Files\GIMP 2 1642 >>>>&0 lestring16 x \b, %-.42s 1643 1644 # URL: https://jrsoftware.org/ishelp/index.php?topic=setup_signeduninstaller 1645 # Reference:https://github.com/jrsoftware/issrc/blob/main/Projects/Struct.pas 1646 # From: Joerg Jenderek 1647 0 string Inno\ Setup\ Messages\ ( 1648 # null padded til 0x40 boundary 1649 >0x38 quad 0 InnoSetup messages 1650 !:mime application/x-innosetup-msg 1651 # unins000.msg, unins001.msg, ... 1652 !:ext msg 1653 # version like 5.1.1 5.1.11 5.5.0 5.5.3 6.0.0 1654 >>0x15 string x \b, version %.5s 1655 # look for 6th char of version string or terminating right parentheses 1656 >>>0x1a ubyte !0x29 \b%c 1657 # NumMessages 1658 >>0x40 ulelong x \b, %u messages 1659 # TotalSize: Cardinal; 1660 #>>0x44 ulelong x \b, TotalSize %u 1661 # NotTotalSize: Cardinal; 1662 #>>0x48 ulelong x \b, NotTotalSize %u 1663 # CRCMessages: Longint; 1664 #>>0x4C ulelong x \b, CRC %#x 1665 >>0x40 ulelong x 1666 # (u) after version means unicoded messages 1667 >>>0x1c search/2 (u) (UTF-16), 1668 >>>>0x50 lestring16 x %s 1669 # ASCII coded message 1670 >>>0x1c default x (ASCII), 1671 >>>>0x50 string x %s 1672 1673 # Windows Imaging (WIM) Image 1674 # Update: Joerg Jenderek at Mar 2019, 2021 1675 # URL: https://en.wikipedia.org/wiki/Windows_Imaging_Format 1676 # http://fileformats.archiveteam.org/wiki/Windows_Imaging_Format 1677 # Reference: https://download.microsoft.com/download/f/e/f/ 1678 # fefdc36e-392d-4678-9e4e-771ffa2692ab/Windows%20Imaging%20File%20Format.rtf 1679 # Note: verified by like `7z t boot.wim` `wiminfo install.esd --header` 1680 0 string MSWIM\000\000\000 1681 >0 use wim-archive 1682 # https://wimlib.net/man1/wimoptimize.html 1683 0 string WLPWM\000\000\000 1684 >0 use wim-archive 1685 0 name wim-archive 1686 # _WIMHEADER_V1_PACKED ImageTag[8] 1687 >0 string x Windows imaging 1688 !:mime application/x-ms-wim 1689 # TO avoid in file version 5.36 error like 1690 # Magdir/windows, 760: Warning: Current entry does not yet have a description 1691 # file: could not find any valid magic files! (No error) 1692 # split WIM 1693 >16 ulelong &0x00000008 (SWM 1694 !:ext swm 1695 # usPartNumber; 1, unless the file was split into multiple parts 1696 >>40 uleshort x \b %u 1697 # usTotalParts; The total number of WIM file parts in a spanned set 1698 >>42 uleshort x \b of %u) image 1699 # non split WIM 1700 >16 ulelong ^0x00000008 1701 # https://wimlib.net/man1/wimmount.html 1702 # solid WIMs; version 3584; usually contain LZMS-compressed and the .esd extension 1703 >>12 ulelong 3584 (ESD) image 1704 !:ext esd 1705 >>12 ulelong !3584 ( 1706 # look for archive member RunTime.xml like in Microsoft.Windows.Cosa.Desktop.Client.ppkg 1707 >>>156 search/68233/s RunTime.xml \bWindows provisioning package) 1708 !:ext ppkg 1709 # if is is not a Windows provisioning package, then it is a WIM 1710 >>>156 default x \bWIM) image 1711 # second disk image part created by Microsoft's RecoveryDrive.exe has name Reconstruct.WIM2 1712 !:ext wim/wim2 1713 >0 string/b WLPWM\000\000\000 \b, wimlib pipable format 1714 # cbSize size of the WIM header in bytes like 208 1715 #>8 ulelong x \b, headersize %u 1716 # dwVersion version of the WIM file 00010d00h~1.13 00000e00h~0.14 1717 >14 uleshort x v%u 1718 >13 ubyte x \b.%u 1719 # dwImageCount; The number of images contained in the WIM file 1720 >44 ulelong >1 \b, %u images 1721 # dwBootIndex 1722 # 1-based index of the bootable image of the WIM, or 0 if no image is bootable 1723 >0x78 ulelong >0 \b, bootable no. %u 1724 # dwFlags 1725 #>16 ulelong x \b, flags %#8.8x 1726 #define FLAG_HEADER_COMPRESSION 0x00000002 1727 #define FLAG_HEADER_READONLY 0x00000004 1728 #define FLAG_HEADER_SPANNED 0x00000008 1729 #define FLAG_HEADER_RESOURCE_ONLY 0x00000010 1730 #define FLAG_HEADER_METADATA_ONLY 0x00000020 1731 #define FLAG_HEADER_WRITE_IN_PROGRESS 0x00000040 1732 #define FLAG_HEADER_RP_FIX 0x00000080 reparse point fixup 1733 #define FLAG_HEADER_COMPRESS_RESERVED 0x00010000 1734 #define FLAG_HEADER_COMPRESS_XPRESS 0x00020000 1735 #define FLAG_HEADER_COMPRESS_LZX 0x00040000 1736 #define FLAG_HEADER_COMPRESS_LZMS 0x00080000 1737 #define FLAG_HEADER_COMPRESS_XPRESS2 0x00100000 wimlib-1.13.0\include\wimlib\header.h 1738 # XPRESS, with small chunk size 1739 >16 ulelong &0x00100000 \b, XPRESS2 1740 >16 ulelong &0x00080000 \b, LZMS 1741 >16 ulelong &0x00040000 \b, LZX 1742 >16 ulelong &0x00020000 \b, XPRESS 1743 >16 ulelong &0x00000002 compressed 1744 >16 ulelong &0x00000004 \b, read only 1745 >16 ulelong &0x00000010 \b, resource only 1746 >16 ulelong &0x00000020 \b, metadata only 1747 >16 ulelong &0x00000080 \b, reparse point fixup 1748 #>16 ulelong &0x00010000 \b, RESERVED 1749 # dwCompressionSize; Uncompressed chunk size for resources or 0 if uncompressed 1750 #>20 ulelong >0 \b, chunk size %u bytes 1751 # gWIMGuid 1752 #>24 ubequad x \b, GUID %#16.16llx 1753 #>>32 ubequad x \b%16.16llx 1754 # rhOffsetTable; the location of the resource lookup table 1755 # wim_reshdr_disk[24]= u8 size_in_wim[7] + u8 flags + le64 offset_in_wim + le64 uncompressed_size 1756 #>48 ubequad x \b, rhOffsetTable %#16.16llx 1757 # rhXmlData; the location of the XML data 1758 #>0x50 ulelong x \b, at %#8.8x 1759 # NOT WORKING \xff\xfe<\0W\0I\0M\0 1760 #>(0x50.l) ubequad x \b, xml=%16.16llx 1761 # rhBootMetadata; the location of the metadata resource 1762 #>0x60 ubequad x \b, rhBootMetadata %#16.16llx 1763 # rhIntegrity; the location of integrity table used to verify files 1764 #>0x7c ubequad x \b, rhIntegrity %#16.16llx 1765 # Unused[60] 1766 #>148 ubequad !0 \b,unused %#16.16llx 1767 # 1768 1769 # From: Joerg Jenderek 1770 # URL: https://en.wikipedia.org/wiki/Windows_Easy_Transfer 1771 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/m/mig.trid.xml 1772 # Note: called "Windows Easy Transfer migration data" by TrID, 1773 # "Migration Store" or "EasyTransfer file" by Microsoft 1774 0 string 1giM Windows Easy Transfer migration data 1775 #!:mime application/octet-stream 1776 !:mime application/x-ms-mig 1777 !:ext mig 1778 >0x18 string =MRTS without password 1779 # data offset with 1 space at end 1780 >>0x1c ulelong+0x38 x \b, at %#x 1781 # look for zlib compressed data by ./compress 1782 >>(0x1c.l+0x38) ubyte x 1783 >>>&-1 indirect x 1784 # in password protected examples MRTS comes some bytes further 1785 >0x18 string !MRTS with password 1786 # look for first MRTS tag 1787 >0x18 search/29/b MRTS 1788 # probably first file name length like 178, ... 1789 #>>&0 ulelong x \b, 1st length %u 1790 # URL like File\C:\Users\nutzer\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 1791 >>&20 lestring16 x \b, 1st %-s 1792 1793 # Microsoft SYLK 1794 # https://en.wikipedia.org/wiki/SYmbolic_LinK_(SYLK) 1795 # https://outflank.nl/upload/sylksum.txt 1796 0 string ID;P Microsoft SYLK program 1797 >4 string >0 \b, created by %s 1798 !:ext slk/sylk 1799 1800 # Summary: Windows Performance Monitor Alert 1801 # From: Joerg Jenderek 1802 # URL: https://en.wikipedia.org/wiki/Performance_Monitor 1803 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/p/pma.trid.xml 1804 # Note: called "Windows Performance Monitor Alert" by TrID 1805 0 ubelong =0xDC058340 1806 >4 ubyte =0 Windows Performance Monitor Alert 1807 #!:mime application/octet-stream 1808 # https://www.thoughtco.com/mime-types-by-content-type-3469108 1809 # https://filext.com/file-extension/PAM 1810 !:mime application/x-perfmon 1811 #!:mime application/x-ms-pma 1812 !:ext pma 1813 # metric type like: "BrowserMetrics" "CrashpadMetrics" "SetupMetrics" 1814 >>80 string x \b, "%s" 1815 1816 # From: Joerg Jenderek 1817 # URL: https://en.wikipedia.org/wiki/InstallShield 1818 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/i/ins.trid.xml 1819 # Note: contain also keywords like: BATCH_INSTALL ISVERSION LOGHANDLE SRCDIR SRCDISK WINDIR WINSYSDISK 1820 0 ubelong 0xB8C90C00 InstallShield Script 1821 #!:mime application/octet-stream 1822 !:mime application/x-installshield-ins 1823 # like test.ins Setup.ins 1824 !:ext ins 1825 # UNKNOWN like: 160034121de07e00 1600341260befe00 16003412e0783700 1826 # 5000010021083f00 50000100b0335600 50000100cbfdf800 50000100dfbc4700 1827 #>4 ubequad x \b, at 4 %#16.16llx 1828 # copyright text like: "Stirling Technologies, Inc. (c) 1990-1994" 1829 # "InstallSHIELD Software Corporation (c) 1990-1997" 1830 >13 pstring/h x "%s" 1831 # look for specific ASCII variable names 1832 >1 search/0x121/s SRCDIR \b, variable names: 1833 # 1st like: SRCDIR 1834 >>&-4 leshort x #%u 1835 >>&-2 pstring/h x %s 1836 # 2nd like: SRCDISK 1837 >>>&0 leshort x #%u 1838 >>>&2 pstring/h x %s 1839 # 3rd like: TARGETDISK 1840 >>>>&0 leshort x #%u 1841 >>>>&2 pstring/h x %s 1842 # 4th like: TARGETDIR 1843 #>>>>>&0 leshort x #%u 1844 #>>>>>&2 pstring/h x %s 1845 # 5th like: WINDIR 1846 #>>>>>>&0 leshort x #%u 1847 #>>>>>>&2 pstring/h x %s 1848 # 6th like: WINDISK 1849 #>>>>>>>&0 leshort x #%u 1850 #>>>>>>>&2 pstring/h x %s 1851 # 7th like: WINSYSDIR 1852 #>>>>>>>>&0 leshort x #%u 1853 #>>>>>>>>&2 pstring/h x %s 1854 # ... LOGHANDLE 1855 >0 ubelong x ... 1856 # 1857 1858 # Summary: Microsoft Remote Desktop Protocol connection 1859 # From: Joerg Jenderek 1860 # URL: https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/clients/rdp-files 1861 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/r/rdp.trid.xml 1862 # Note: called "Remote Desktop Connection Settings" by TrID 1863 0 string screen\040mode\040id:i: Remote Desktop Protocol connection 1864 #!:mime text/plain 1865 !:mime text/x-ms-rdp 1866 !:ext rdp 1867 # Screen mode: 1~session appear in a window 2~session appear full screen 1868 >17 string 1 \b, window mode 1869 >17 string 2 \b, full screen mode 1870 1871 0 guid 7B5C52E4-D88C-4DA7-AEB1-5378D02996D3 Microsoft OneNote 1872 !:ext one 1873 !:mime application/onenote 1874 0 guid 43FF2FA1-EFD9-4C76-9EE2-10EA5722765F Microsoft OneNote Revision Store File 1875 1876 # Microsoft XAML Binary Format 1877 # From: Alexandre Iooss <erdnaxe (a] crans.org> 1878 # URL: https://github.com/WalkingCat/XbfDump/blob/8832d2ffcaa738434d803fefa2ba99d3af37ed29/xbf_data.h 1879 0 string XBF\0 1880 >12 ulelong <0xFF 1881 >>16 ulelong <0xFF Microsoft XAML Binary Format 1882 !:ext xbf 1883 >>>12 ulelong x %d 1884 >>>16 ulelong x \b.%d 1885 >>>4 ulelong x \b, metadata size: %d bytes 1886 >>>8 ulelong x \b, node size: %d bytes 1887 1888 # Metaswitch MetaView Service Assurance Server exports 1889 0 string MetaView\x20Service\x20Assurance\x20Export\x20File MetaView SAS export 1890 >39 string Version\x20 1891 >>47 byte x \b, version %c 1892 1893 # Active Directory Group Policy Registry Policy File Format 1894 # From: Yuuta Liang <yuuta (a] yuuta.moe> 1895 # URL: https://learn.microsoft.com/en-us/previous-versions/windows/desktop/policy/registry-policy-file-format 1896 0 string PReg 1897 >4 lelong x Group Policy Registry Policy, Version=%d 1898 1899 # Microsoft Type Library Format (.TLB file) 1900 # Stores metadata on calling COM APIs (method parameters/etc) 1901 # Exists in two formats: the original (SLTG aka Type 1) and a newer format (MSFT aka Type 2) 1902 # SLTG: https://www.nationalarchives.gov.uk/PRONOM/fmt/1601 1903 # MSFT: https://www.nationalarchives.gov.uk/PRONOM/fmt/1602 1904 # (Pronom claims these formats are due to Borland, but that appears to be incorrect, Microsoft invented them.) 1905 # The MSFT format is documented here: https://gist.github.com/djhohnstein/e4a346ee1506895000ca0fa93e5a0024 1906 # Which is a copy of original: http://theircorp.byethost11.com/files/TypeLib.txt (but which displays incorrectly due to encoding issues) 1907 # The MSFT format is generated by the Windows CreateTypeLib2 API: https://learn.microsoft.com/en-us/windows/win32/api/oleauto/nf-oleauto-createtypelib2 1908 # The SLTG format is generated by the Windows CreateTypeLib API: https://learn.microsoft.com/en-us/windows/win32/api/oleauto/nf-oleauto-createtypelib 1909 # 1910 # Note type libraries can also be embedded as resources inside executables/DLL. No attempt is made here to detect that scenario. 1911 1912 # Legacy SLTG format 1913 0 string SLTG 1914 >-36 string TYPELIB Type Library (legacy SLTG format) 1915 1916 # MSFT format 1917 0 string MSFT\x02\x00\x01\x00 Type Library (MSFT format) 1918 1919 # Magic file for OllyDbg 2.01 Module Info files (.udd) 1920 0 string Mod\x00 OllyDbg 2.0 Module Info File 1921 1922 # COFF object files for OMNI VM 1923 # MSVC6.0 CVTRES.EXE can create COFF binary for OMNI by /MACHINE:OMNI flag 1924 0 leshort =0xace1 1925 >0 use display-coff 1926
Indexes created Mon Jun 29 00:24:49 UTC 2026